Exchange OWA Zero-Day Exploit Deploys OWAReaper Backdoor

The modern cyber-espionage threat landscape has reached a dangerous inflection point where victim interaction is no longer required to compromise complex enterprise networks. On July 29, 2026, cybersecurity researchers at Proofpoint released a landmark technical disclosure exposing an active, high-impact espionage campaign conducted by the Russian state-sponsored threat actor known as Laundry Bear (tracked externally as Void Blizzard, TA488, or CL-STA-1114). By weaponizing an Exchange OWA zero-day vulnerability tracked as CVE-2026-42897, the threat group launched a wave of covert intrusions targeting government agencies, critical infrastructure entities, and global strategic industries across the United States and Europe. The attack sequence deploys a novel, browser-resident backdoor dubbed OWAReaper, granting adversaries sustained access to confidential organizational communications while bypassing conventional perimeter defenses.

This offensive operation represents a major escalation in state-backed webmail exploitation. By exploiting improper input sanitization within Microsoft Exchange Server’s web rendering pipeline, Laundry Bear achieved automated JavaScript code