Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Laundry Bear. Show all posts
Zero-Day
DNS Attack Drift OAuth token hack email security exchange Laundry Bear microsoft OWA Zero-Day

Russian Hackers Use Exchange Zero-Day in Email Attacks

 



Russia-aligned cyberespionage group Laundry Bear, also tracked as Void Blizzard and TA488, is exploiting a Microsoft Exchange Outlook Web Access (OWA) vulnerability to deploy a browser-based backdoor capable of maintaining access to victims' mailboxes even after credentials are changed or systems are reimaged.

Email security firm Proofpoint said it observed the campaign targeting government organizations in the US and Europe, as well as telecommunications, financial, hospitality and aerospace organizations. The activity uses OWAReaper, a sophisticated backdoor delivered through malicious emails exploiting CVE-2026-42897.

CVE-2026-42897 is a cross-site scripting vulnerability caused by inadequate HTML sanitization in OWA. A specially crafted email can contain malicious JavaScript that executes when the recipient opens the message in OWA. Proofpoint calls the technique a "half-click" exploit because opening the email can be enough to trigger the attack, without requiring the victim to click a link or open an attachment. Microsoft disclosed the vulnerability on May 14, 2026, and confirmed active exploitation.

Proofpoint found that infrastructure associated with the campaign had been established as early as March, nearly two months before Microsoft's disclosure, suggesting TA488 may have exploited the vulnerability as a zero-day. The group used ordinary-looking subjects concerning supply chains, research updates, tourism, gas markets and other industry-related information, making the messages less likely to be treated as malicious.

The emails contained JavaScript loaders and Base64-encoded payload fragments hidden within URLs associated with social-media-style icons. Once triggered, the code assembled and executed the OWAReaper payload.

OWAReaper operates entirely within the OWA reading pane. It can collect the victim's email address, username and Outlook configuration, while also attempting to capture credentials by creating invisible DOM elements that allow the browser's autofill mechanism to populate usernames and passwords.

The backdoor's most concerning capability is its persistence. It searches for Outlook add-ins with "ReadWriteMailbox" permissions and can use the "GetClientAccessToken" operation to obtain OAuth tokens. It then abuses Exchange's "UpdateFolder" operation to grant Owner-level permissions to the "Default" user across the victim's mail folders.

Because these permissions are stored server-side, changing the victim's password or reinstalling the compromised computer does not necessarily remove the attacker's access. OWAReaper also enables browser caching and places a malicious iframe into messages stored in OWA's offline IndexedDB database, allowing the payload to execute again when a poisoned message is opened from the cache.

The malware uses multiple channels for command and control. It periodically searches GitHub commit messages for encrypted commands containing the victim's email address and can also receive commands through specially formatted emails stored in OWA's cache.

For data theft, OWAReaper primarily uses HTTPS with encrypted URI paths that can be routed through image CDN services. It also has a direct-server fallback and a DNS-based exfiltration mechanism that encrypts and Base32-encodes stolen data before transmitting it through DNS queries.

Proofpoint linked OWAReaper to TA488 based on behavioral similarities with ZimReaper, malware previously used by the group against Zimbra email servers. In that campaign, TA488 exploited another XSS flaw, CVE-2025-66376, to steal emails, passwords, application passcodes and two-factor authentication codes.

The latest campaign therefore represents an evolution of the group's "half-click" approach, shifting from compromising individual webmail sessions toward establishing persistent access within the victim's mailbox environment.

Microsoft has since released security updates addressing CVE-2026-42897. The July 2026 Exchange Server update states that the code fix is available, while organizations that previously applied Microsoft's mitigation must follow Microsoft's guidance to remove it after installing the update. The vulnerability affects on-premises Exchange Server deployments, while Exchange Online is not affected.

Proofpoint has published indicators of compromise for the campaign, including malicious domains and the HTML message body containing the exploit and OWAReaper payload. Organizations using affected on-premises Exchange deployments should therefore investigate not only compromised endpoints, but also mailbox permissions, OAuth tokens and OWA browser storage when responding to suspected exploitation.

Read more »
Zimbra Zero-Day
CVE-2025-66376 cyber espionage email security Laundry Bear Russian Espionage Group Two-Factor Authentication Vulnerabilities and Exploits Zero-Day Exploit Zimbra Security Zimbra Zero-Day

Russian Cyber Spies Exploited Critical Zimbra Flaw to Access Emails and 2FA Codes


 

Cyber espionage groups backed by the Russian government exploited a previously unknown vulnerability in the Zimbra Collaboration Suite (ZCS) in order to steal emails, browser credentials, and two-factor authentication (2FA) recovery codes from government and commercial organizations throughout the world, according to a joint cybersecurity advisory issued by the U.S. National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and international partners. 

In the campaign, CVE-2025-66376 was used to exploit a stored cross-site scripting (XSS) vulnerability affecting Zimbra's Classic Web Client. According to Proofpoint, the flaw was exploited as a zero-day attack for at least five months before a security patch was available in November 2025, identified by Palo Alto Networks Unit 42 as CL-STA-1114. It is reported by the Dutch General Intelligence and Security Service (AIVD) that the activity is referred to as Laundry Bear, while cybersecurity vendors continue to use different tracking names for the same or similar threats. 

The vulnerability allowed attackers to compromise users by merely opening or previewing a specially crafted HTML email in a Zimbra session that was vulnerable. Upon activating the malicious JavaScript within the authenticated webmail session, attackers gained access to the victim's mailbox without requiring additional interaction from them. 

The campaign has been described as a "half-click" phishing attack by security researchers, as the victim only needed to browse or open the malicious email in Zimbra's Classic Web Client to gain access. As opposed to conventional phishing campaigns that require the user to click links or download attachments, the exploit executed automatically when the email was rendered, which permitted the execution of arbitrary JavaScript within the authenticated webmail session. 

According to researchers, the ZimReaper malware harvested emails from the last 90 days, the organization's Global Address List, browser-stored passwords, details on Zimbra versions and recovery codes for two-factor authentication. Besides exfiltrating data through DNS queries, attackers also created app-specific passwords for retaining persistent access to compromised accounts even after password changes. 

In accordance with the advisory, the campaign targeted government, military, transportation, financial, and scientific organizations throughout NATO member countries, Ukraine, the Commonwealth of Independent States, Africa, and the United States. Researchers did not disclose the number or identities of affected organizations. The operation is believed to have been conducted in support of Russian intelligence objectives to gather sensitive information.

One of the longest-running known exploit campaigns against Zimbra was launched in July 2025, according to intelligence officials. It was publicly disclosed and patched in August 2025, making it one of the longest-running known exploit campaigns. Versions 10.0.18 and 10.1.13 of Zimbra addressed the vulnerability, while CISA added it to its Known Exploited Vulnerabilities (KEV) catalog in March of 2026. 

According to security experts, applying a patch alone will not be sufficient if a system has been compromised since the update occurred. Although Zimbra released a fix in November 2025, the vulnerability was not assigned a CVE identifier until several weeks later and was publicly documented. It has been argued that the delayed disclosure may have contributed to organizations remaining unaware of the active threat while attackers continued to exploit vulnerable servers. 

In addition to upgrading to supported Zimbra releases, organizations are advised to reset passwords for accounts that may be affected, invalidate active sessions, generate 2FA recovery codes, remove unauthorized passwords for applications, and review logs for suspicious activities. Admins should also monitor for unusual DNS requests and inspect email correspondence for indicators associated with the exploit. 

Furthermore, Proofpoint researchers warned that other threat actors have continued exploiting unpatched Zimbra servers, indicating that the vulnerability is still appealing beyond the Russian espionage campaign that originally exploited it. Additionally, the researchers noted that although no evidence has been provided to suggest that the exploit itself was created using artificial intelligence, large language models may assist attackers in identifying future methods for bypassing security patches. 

Despite the absence of activity from the threat group since February 2026, Unit 42 and government agencies remain concerned that attackers continue to target Zimbra environments that are not patched. The advisory warns that Russian espionage actors are likely to continue pursuing email platforms to support intelligence-gathering operations. 

Several zero-day vulnerabilities have been exploited rapidly in this campaign, compromising trusted communication platforms. Organizations using Zimbra are encouraged to ensure that systems are fully patched, review accounts for signs of compromise, revoke unauthorized access, and continuously monitor their environments as a preventative measure against persistent espionage.
Read more »
Zimbra vulnerability
CISA CVE-2025-66376 Laundry Bear Void Blizzard Vulnerabilities and Exploits Zimbra Collaboration Suite Zimbra vulnerability

Russian Hacking Group Laundry Bear Exploits Zimbra Flaw to Steal Emails and MFA Data: CISA


 The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a Russian state-backed cyber espionage group known as Laundry Bear, also tracked as Void Blizzard, which is targeting organizations running Zimbra Collaboration email servers.

The campaign combines phishing techniques with the exploitation of a Zimbra security vulnerability that has since been patched. CISA said the group has compromised organizations linked to the Defense Industrial Base (DIB), federal and local governments, educational institutions, energy companies, law enforcement agencies, media organizations, non-governmental organizations, and the technology sector.

At the centre of the campaign is CVE-2025-66376, a cross-site scripting (XSS) vulnerability in the Classic UI of Zimbra Collaboration Suite. The flaw could allow malicious JavaScript contained within specially crafted HTML emails to execute when the message was opened. This means attackers could potentially steal sensitive account information without requiring victims to click on a malicious link or access a fraudulent website.

CISA said Laundry Bear used the vulnerability as a zero-day before Zimbra released a patch in November 2025. Despite the availability of a fix, the group continues to target organizations operating vulnerable and unpatched Zimbra servers. CISA subsequently classified the vulnerability as being actively exploited.

The exploitation enables attackers to collect a wide range of information from compromised accounts. According to CISA, this includes a victim's emails from the previous 90 days, email address, password, Global Address List (GAL), and two-factor authentication (2FA) tokens.

The attackers can also generate and send a new Zimbra application passcode. Such passcodes are used by older email clients, including IMAP and ActiveSync, that cannot use TOTP-based authentication. By obtaining an application passcode, attackers can maintain access to compromised accounts even when multi-factor authentication (MFA) is enabled.

Data Exfiltration Through DNS and HTTPS

CISA said Laundry Bear transfers stolen information to infrastructure controlled by the attackers using both DNS and HTTPS. The group relies on its "Flowerbed" collection framework to receive the stolen data.

Smaller pieces of information are encoded and transmitted through DNS A-record queries, while larger datasets, including mailbox contents, are sent over HTTPS. The larger data packages are compressed before being uploaded to attacker-controlled servers.

The campaign is not limited to exploiting Zimbra's vulnerability. Laundry Bear has also deployed adversary-in-the-middle (AiTM) phishing kits that mimic genuine Zimbra login pages. These fraudulent portals are designed to capture users' credentials and session cookies, potentially allowing attackers to take over email accounts.

CISA's indicators of compromise identified several domains designed to resemble legitimate Zimbra-related infrastructure. These include 'mailnalysis.com', 'emailanalytics.com.ua', 'zimbrastat.com', 'zimbra-metadata.com', 'istc-cloud.com', and 'zmailanalytics.com'.

CISA Issues Security Recommendations

Organizations using Zimbra Collaboration Suite have been advised to take several steps to reduce the risk of compromise. CISA recommends:

  • Updating Zimbra Collaboration Suite to the latest available version and applying all security patches.

  • Reviewing CISA's published indicators of compromise.

  • Checking networks and systems for communications with the identified domains and IP addresses.

  • Monitoring accounts for unusual or suspicious authentication activity.

  • Revoking unauthorized application passcodes, particularly those containing the 'ZimbraWeb'.

  • Examining user accounts for signs of unauthorized mailbox access.

  • Deploying phishing-resistant MFA wherever technically possible.

Laundry Bear's Growing Cyber Espionage Activity

Laundry Bear was publicly linked to Russian cyber espionage activity in May 2025, when Dutch intelligence agencies attributed the group to a 2024 intrusion into the Dutch National Police. The incident resulted in the exposure of personal information belonging to police personnel and helped authorities identify a previously unknown Russian espionage operation.

Microsoft tracks the group as Void Blizzard. The threat actor has reportedly been active since at least 2024, focusing on intelligence-gathering operations against organizations considered strategically relevant to Russia. Its activity has largely centred on NATO member countries and Ukraine.

Microsoft has also reported successful intrusions into organizations supporting Ukraine, including those operating in the defense, transportation, and aviation industries.

Laundry Bear has previously used phishing as part of its operations. Earlier in 2026, a separate campaign attributed to the group targeted Ukraine's military with charity-themed phishing messages. The emails reportedly attempted to distribute malware disguised as donation-related requests.

The latest campaign highlights the continued risk posed by unpatched collaboration and email platforms, particularly when attackers combine software vulnerabilities with credential theft and phishing techniques to maintain long-term access to sensitive communications.

Read more »
Subscribe to: Posts (Atom)