Laundry Bear Exploits Microsoft Exchange Vulnerability in Targeted Attacks
Laundry Bear, a cyber espionage group associated with Russia, is actively exploiting a cross-site scripting vulnerability in Microsoft Exchange, designated CVE-2026-42897. This vulnerability is being used to target various government entities and private organizations across the US and Europe through email campaigns. Proofpoint has identified that the group is sending emails that appear benign, with mundane subject lines designed to encourage users to open them without raising suspicion. These emails do not contain any suspicious URLs or attachments, making them more likely to be overlooked as junk mail.
The exploit affects the webmail interface of Exchange, where it constructs a JavaScript loader from payload blobs embedded in the HTML of the email body. This loader ultimately deploys OWAReaper, a backdoor that operates within the reading pane of Outlook Web Access (OWA). Proofpoint has highlighted that this aspect of the infection chain is crucial; if Laundry Bear gains access to other accounts within the organization, they can maintain persistent access to the targeted mailbox. This persistent access resides on the server side, necessitating deliberate removal from the Exchange server, as simple credential rotation or re-imaging of the affected device will not eliminate the threat.
Additionally, the exploit adds a hidden iframe to messages stored in OWA’s offline IndexedDB message cache, enabling reinfection of re-imaged hosts if the victim opens a compromised email from the cache. OWAReaper is capable of executing commands fetched from public GitHub commit messages or through inbound emails from the attacker, and it can exfiltrate data via HTTPS or DNS.
Proofpoint noted that OWAReaper represents an evolution of the ZimReaper payload, which was previously utilized in a 2025 campaign that exploited an undisclosed vulnerability in Zimbra mail servers. The two payloads share similar code, behavior, and error-handling mechanisms.
Microsoft initially warned about the exploitation of CVE-2026-42897 in May 2026, providing a temporary mitigation before releasing a definitive fix in June 2026. Researchers have indicated that the infrastructure related to this campaign was established in March 2026, two months prior to Microsoft’s emergency patch, suggesting that Laundry Bear may have leveraged this vulnerability as a zero-day exploit.
Organizations are strongly advised to apply the patch for CVE-2026-42897. Those who suspect they may have been targeted should utilize indicators of compromise to assess their systems. In the event of a compromise, a thorough cleanup process is recommended, which includes sanitizing affected endpoints, the mail server, and revoking any tokens associated with the breach.
