Executive Summary
In July 2026, the Russia-aligned threat actor TA488 (also known as Void Blizzard or Laundry Bear) launched a widespread campaign targeting government, telecommunications, and financial sectors across the US and Europe. The attack utilizes a 'half-click' exploit targeting CVE-2026-42897, a cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA). By simply opening a generic-looking email, victims trigger an infection chain that installs a novel JavaScript implant called OWAReaper.
OWAReaper represents a significant advancement in TA488 tradecraft, operating entirely within the OWA browser context with no permanent host footprint. It utilizes sophisticated persistence mechanisms including modification of OWA local storage and the hijacking of Exchange folder permissions. Because these techniques often target server-side settings or browser-synced data, the implant can survive credential rotations and full device re-imaging.
The use of infrastructure created months before the public patch suggests TA488 likely utilized CVE-2026-42897 as a zero-day. This campaign underscores the persistent threat to webmail interfaces and the evolving capability of state-sponsored actors to maintain long-term access through unconventional persistence vectors.