TA488 Espionage Group Resurfaces with Outlook Web Access Attacks
The espionage group TA488, also known as Void Blizzard and Laundry Bear, has resurfaced after several months of inactivity, launching a campaign that exploits a vulnerability in on-premises Outlook Web Access (OWA). This campaign, which began on July 22, utilizes a half-click exploit to deploy a browser-resident implant called OWAReaper, allowing the group to establish server-side persistence that can withstand credential rotation and device re-imaging. Proofpoint published its findings on July 29, shortly after the group was mentioned in a joint advisory with the NSA regarding its previous activities involving Zimbra.
TA488's targets include U.S. and European government entities, as well as sectors such as telecommunications, finance, hospitality, and aerospace. The volume of attacks is notably higher than usual for the group, suggesting a strategy to blend in with mass-mailing spam. The exploit leverages CVE-2026-42897, a cross-site scripting vulnerability affecting on-premises Exchange Server, rather than Exchange Online. When victims open the email in a vulnerable OWA client, the embedded JavaScript executes within their authenticated session.
The email lures used in this campaign were intentionally mundane, featuring subject lines related to semiconductor supply chains, gas markets, and tourism metrics. This approach likely aimed to encourage recipients to open and quickly skim the messages, leading them to dismiss them as junk without reporting any suspicious content.
OWAReaper is described by Proofpoint as the most sophisticated half-click backdoor they have encountered. It builds upon the ZimReaper tool from the group's earlier Zimbra campaigns, which focused on mass email exfiltration. OWAReaper operates entirely within the OWA reading pane, avoiding conventional file storage on disk. It rewrites the original email on the server to remove the exploit, harvests saved credentials, and hides an encrypted copy of itself in the browser's localStorage under a legitimate OWA settings key, ensuring it re-executes with every new tab.
The implant's most resilient feature is its server-side mechanism. In environments where add-ins with mailbox write permissions exist, it steals OAuth tokens and grants the Exchange Default user Owner-level permissions on all mail folders, thereby exposing the mailbox to any authenticated account within the organization. Additionally, it embeds a hidden iframe in messages stored in OWA's offline IndexedDB cache, allowing it to reinfect the target even after a device has been re-imaged. This persistence is maintained because the folder-permission grants reside server-side and require deliberate removal from Exchange, meaning that credential rotation and re-imaging do not eliminate the threat.
Commands for the implant are delivered through GitHub commit messages, which are queried daily, or via inbound emails polled every five minutes. Data exfiltration occurs over HTTPS, using legitimate content delivery networks for proxying, with a fallback to DNS tunneling. The infrastructure supporting this campaign dates back to March 2026, approximately two months prior to Microsoft's disclosure of the vulnerability, indicating that zero-day exploitation was possible. Microsoft has since released security updates for Exchange to address this flaw.
In addition to applying patches, Proofpoint recommends that organizations revoke Exchange Web Services tokens, remove Default-user folder grants, and clear OWA's offline database and localStorage key to mitigate the risks associated with this attack.
