Proofpoint has disclosed a campaign by the Russian state-sponsored group Laundry Bear that exploited CVE-2026-42897, a cross-site scripting vulnerability in Microsoft Exchange Outlook Web Access, as a zero-day before Microsoft’s May 14 patch. The half-click campaign — where victims only need to open or preview a malicious email to trigger the exploit — delivered OWAReaper, which researchers describe as the most sophisticated backdoor delivered through half-click techniques they have observed. The campaign infrastructure was set up beginning in March, with the zero-day exploited prior to the May security update that closed the vulnerability.
The Half-Click Zero-Day Exploit Chain
The Laundry Bear campaign used lure emails designed around supply-chain analyses, research updates, and performance indicators for tourism and gas markets — topics crafted to be opened by recipients and dismissed as non-urgent rather than reported. The XSS vulnerability in Exchange OWA meant that simply previewing the email in the browser-based client triggered the exploit without requiring the victim to click any link or open any attachment. Microsoft’s patch for CVE-2026-42897 was released in May, but Proofpoint’s findings indicate that the backdoor access established before patching can persist indefinitely.
The OWAReaper Backdoor’s Capabilities
OWAReaper represents a significant advancement in tradecraft for Laundry Bear, according to Proofpoint researchers. The backdoor uses Outlook APIs to rewrite the email on the Exchange server and remove exploit content after execution, simultaneously disabling OWA pop-up notifications and right-click functionality to reduce the chance the victim notices anything unusual. The backdoor communicates through two command-and-control mechanisms: the GitHub Commit Search API for encrypted command delivery, and parsing of specially formatted emails sitting in the victim’s own inbox. Data exfiltration operates over HTTPS through AES-CTR encrypted URI paths proxied through image CDN domains, with DNS-based exfiltration as a fallback. The dual C2 architecture provides redundancy — if one mechanism is detected and blocked, the backdoor can continue operating through the alternative channel.
The Server-Side Persistence That Survives Credential Changes
The most notable technical feature of OWAReaper is its server-side persistence model. The backdoor grants itself Owner-level permissions to the Default user alias on every mail folder in the compromised mailbox. Because these permissions are configured at the Exchange server level, they persist even if the compromised user’s password is changed, their workstation is reimaged, or their OAuth tokens are revoked. A second persistence mechanism injects malicious iframes into OWA’s offline IndexedDB cache, so the backdoor re-executes every time the victim opens a cached poisoned email. This dual persistence model makes OWAReaper exceptionally difficult to remove through standard remediation procedures.
Targeted Sectors and Intelligence Collection Objectives
Proofpoint documented Laundry Bear targeting government agencies in the United States and Europe, along with telecommunications, financial, hospitality, and aerospace companies. The breadth of targeting suggests the group is collecting intelligence across multiple sectors rather than pursuing a single strategic objective. The use of supply-chain and economic performance lure topics indicates the group tailors its pretexts to the specific interests of each target organization.
Remediation Beyond the May Patch
Organizations using Exchange on-premises OWA should apply the May security update if they have not already. However, patching alone does not address existing compromises. Because OWAReaper configures server-side mailbox permissions that survive credential changes, organizations must audit Exchange mailbox permissions for unauthorized modifications to the Default user alias on mail folders and review GitHub Commit Search API traffic from internal networks for suspicious query patterns. The campaign highlights a gap in standard incident response procedures for email compromises: most remediation workflows focus on endpoint cleanup and credential rotation, neither of which removes server-side permission grants that the backdoor establishes. Responders must add Exchange server-side permission auditing to their post-incident checklist and verify that no hidden mailbox folder permissions have been set for the Default user alias across all mailboxes in the organization.
