LAUNDRY BEAR

Two independently-operating Russian state clusters converged this week on the government user's mailbox and the government user's travel — and both leave persistence that a patch or a password reset does not remove

If you did nothing this week: if you run Exchange on premises, a mailbox in your estate may be readable by an actor who no longer needs anyone's password; and if your staff travelled and used hotel or conference Wi-Fi since early May, their session tokens may already be replayable from somewhere else.

The two disclosures are unrelated in operator and identical in target logic. Proofpoint attributed active exploitation of CVE-2026-42897 to LAUNDRY BEAR, describing a flaw where "the server does not adequately sanitize HTML in the message body", allowing "a loader piece of JavaScript to use the onload= event handler to parse the rest of the message body, assemble a Base64 fragment, and execute it as encoded JavaScript" (Proofpoint, 2026-07-29). Opening the message in Outlook Web Access is the whole of the victim interaction. The resulting implant, OWAReaper, is browser-resident with no artifact on the endpoint, and its persistence mechanism is the part that outlasts incident response: it grants the Exchange "Default" alias Owner permission across mail folders, which Proofpoint states plainly means "this persistent access lives on the server-side and requires deliberate removal from the Exchange server; credential rotation and even full re-imaging of the targeted user's device will not evict the actor" (Proofpoint, 2026-07-29). Only on-premises Exchange is in scope, and the permanent fix is the July 2026 Exchange Security Update — which Microsoft notes does not automatically remove the mitigations an administrator applied earlier for the same CVE (Microsoft Exchange Team, 2026-07-14). NCSC Switzerland carried the exploitation to its own constituency on 2026-07-30 (NCSC Switzerland, 2026-07-30).

Microsoft's disclosure moves the same targeting to the travel path. It states that "Microsoft Threat Intelligence assesses that Storm-2945 is an operational sub-cluster of Midnight Blizzard based on distinctive technical and operational overlaps" (Microsoft Threat Intelligence, 2026-07-31). Since early May the cluster has manipulated DNS and HTTP traffic on hospitality networks served by captive portals, answering the browser's own automatic connectivity check with a fake browser or operating-system update prompt — so the lure fires before the user has browsed anywhere. The payloads are built to be difficult to remove and valuable to keep: CornFlake, a Go Windows RAT, "establishes redundant persistence mechanisms: Windows service registrations, Registry Run keys, named scheduled tasks, and a persistence watchdog routine that runs continuously to restore any persistence mechanism that is removed by defenders or endpoint protection" (Microsoft Threat Intelligence, 2026-07-31), while ChocoShell, an in-memory PowerShell stealer, "collects Microsoft 365 and Azure Active Directory (AD) access tokens, refresh tokens, and Web Account Manager (WAM) tokens from .tbres files in the Token Broker cache", which Microsoft assesses lets actors "replay SSO sessions without browser cookies" (Microsoft Threat Intelligence, 2026-07-31). Independent research into the same tradecraft class found compromised Wi-Fi gateways "across multiple US cities and internationally in India and Saudi Arabia, primarily in hotel and hospitality organizations" (ReliaQuest, 2026-07-23).

The identity layer is where the two paths rejoin, and where a third in-window development sharpens the picture: some CaptiveCrunch landing pages have driven users into the Entra ID device-code authentication flow since 16 July (Microsoft Threat Intelligence, 2026-07-31), the same flow a separate criminal operation ran a fresh wave of this week from commercially-trusted hosting infrastructure. A stolen refresh or WAM token and a mailbox-folder permission grant have the same property: both are authorisations rather than credentials, so the standard incident response of resetting the password and rebuilding the laptop closes neither.

Triage: the OWA case produces no endpoint artifact at all, so process-level telemetry will be silent; the signal is server-side, in mailbox-permission change events granting rights to the "Default" alias and in add-in or OAuth grants appearing on accounts that never installed one. For the travel case, the discriminator is sequence and location rather than the update prompt itself — a browser or OS update package fetched moments after a device associated with a new wireless network, from a host that is not the vendor's update infrastructure, with the connectivity-check request immediately preceding it. The lure's mechanics give a second, sharper signal: these are paste-and-run instructions, so Microsoft's own guidance is to teach users to recognise ClickFix-style prompts and fake verification checks "especially when they invoke command interpreters or script hosts such as cmd.exe, PowerShell, rundll32.exe, or mshta.exe" (Microsoft Threat Intelligence, 2026-07-31) — so a script host spawned from a browser process shortly after a captive-portal association is the process-lineage version of the same test. On the collection side, CornFlake carries a ChromeKatz-derived module doing live cookie extraction from Chromium process memory and stored-password extraction from on-disk databases, including an App-Bound Encryption bypass and Firefox NSS decryption (Microsoft Threat Intelligence, 2026-07-31); a non-browser process reading a browser's credential store or its live memory is the detectable artifact, and it sits alongside the token theft rather than replacing it. On the identity side, a successful sign-in whose token was minted through the device-code flow for a user whose role never requires it, or an SSO session replayed from an address class inconsistent with the user's own context, is the shape both clusters ultimately produce.

Builds on: 2026-07-31/ta488-exchange-owa-cve-2026-42897-owareaper-implant · 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · 2026-08-01/device-code-phishing-bl-networks-second-wave-2026

CVE-2026-42897 — Exchange OWA stored XSS weaponised by TA488/LAUNDRY BEAR as a probable zero-day, delivering the browser-resident OWAReaper implant

UPDATE · originally covered CVE-2026-42897 Exchange OWA — EM Service auto-mitigation depends on outbound connectivity to officemitigations.microsoft.com (2026-05-18)

the May entry tracked CVE-2026-42897 as an Exchange OWA flaw whose interim protection depended on the EM Service auto-mitigation. Two things changed. Proofpoint has now attributed in-the-wild exploitation to a named Russian state-supported actor and published the implant's full mechanics (Proofpoint, 2026-07-29), and the mitigation is no longer the remediation — the July 2026 Security Update is, with the mitigation now something that must be actively torn down (Microsoft Exchange Team Blog, 2026-07-14). NCSC-CH appended the Proofpoint reporting to its own advisory on 2026-07-30 (NCSC Switzerland, 2026-07-30).

The actor is TA488, which Microsoft tracks as Void Blizzard and which this pipeline registers as LAUNDRY BEAR — the same Russian state-supported email-espionage actor a 16-nation joint advisory exposed on 2026-07-23 for its Zimbra campaign. Proofpoint assesses OWAReaper as an evolution of that campaign's ZimReaper payload, citing shared code including an identical invisible-element sizing and error-handling pattern (Proofpoint, 2026-07-29). Campaign activity began 2026-07-22 against government, telecommunications, finance, hospitality and aerospace targets across the US and Europe, using deliberately banal lure subjects with no call to action — Proofpoint reads the unusual breadth as intentional blending with bulk mail. Its stated infrastructure-creation date of March 2026 precedes Microsoft's May disclosure by two months, which is the basis for its assessment that zero-day use is feasible; that is an inference from infrastructure dating, not a confirmed finding.

Execution. The flaw is a failure to sanitise HTML in the message body, so a loader script in an onload= handler reassembles a Base64 fragment from the rest of the message and evaluates it — no link click and no attachment open, only viewing the message in OWA. The exploit and payload fragments are hidden inside the message's social-media icon elements, with next-stage data placed after # fragment markers where the browser's Base64 image parser stops reading, so the payload is not visible to casual inspection of the HTML. On execution OWAReaper first rewrites the delivered message server-side to strip the exploit content and suppresses OWA pop-ups and right-click, then enumerates the victim's address, username and settings.

Credential and token theft. It creates two invisible input elements and waits for the browser's own autofill to populate them with the saved OWA username and password. Separately it enumerates installed Outlook add-ins holding ReadWriteMailbox permission and, where one exists, abuses it to call GetClientAccessToken and obtain OAuth tokens.

Persistence, in three independent layers. Client-side, the implant writes an AES-encrypted copy of itself and a decryption wrapper into browser localStorage under a settings field of the legitimate PageDataPayload.OwaUserDefaultSettings key, which OWA itself evaluates during its own sync-restore flow — so every ordinary OWA tab-open re-launches it with no separate loader. A second client-side layer adds a hidden iframe to messages cached in OWA's offline IndexedDB store, so opening the cached message re-infects an endpoint even after a full re-image. The third is server-side and is the one that matters most: the implant calls UpdateFolder to grant Owner-level permission on every mail folder to the low-privilege "Default" preset alias that exists in every Exchange organisation. Proofpoint is explicit that this "requires deliberate removal from the Exchange server" and that credential rotation and re-imaging will not evict it.

Command and control. Two channels, both over infrastructure defenders generally trust. The implant polls GitHub's public Commit Search API every 24 hours for crafted commit messages containing the target's own email address, decrypting matches to a four-character command header that selects toolkit replacement, C2-domain rotation, or one-off code execution; in parallel it re-parses cached inbound messages every five minutes for the same command structure. Exfiltration runs primarily over HTTPS with encrypted URI paths, either relayed through a set of legitimate image-CDN domains or sent directly to the actor-controlled server when those proxies fail; if the HTTPS method fails altogether, the implant switches to DNS label tunnelling, packing the data into the subdomain labels of ordinary DNS queries for an actor-controlled domain. Notably, Proofpoint states there is no mass mailbox exfiltration here, unlike the Zimbra campaign — which is why this entry maps browser-session and credential-access behaviour rather than bulk email collection.

Patching. The permanent fix is the July 2026 Security Update, available as Exchange SE RTM publicly and for Exchange 2019 CU14/CU15 and Exchange 2016 CU23 only through the Period 2 Extended Security Update programme; organisations that were enrolled only in Period 1, which ended in April 2026, do not receive it (Microsoft Exchange Team Blog, 2026-07-14). Microsoft's own vulnerability record scores the flaw 8.1 and marks it exploited (Microsoft Security Response Center, 2026-07-14). Installing the update does not remove a previously applied mitigation: administrators who used the EM Service must remove the M2.1.0 IIS rules through the documented rollback, and those who ran the downloadable mitigation script must run its rollback. The known operational side effects of the mitigation era — broken OWA calendar printing, inline-image rendering problems, OWA-light failing, and false-unhealthy calendar-proxy health alerts — only clear once both steps are done, so a server left on mitigation-only status keeps them indefinitely (Microsoft Exchange Team Blog, 2026-05-14).

Detection. The highest-value signal is in mailbox audit and Exchange Web Services telemetry: a folder-permission change granting Owner rights to the "Default" alias, applied across many folders of one mailbox in quick succession. Client-side, monitor for writes to the OWA user-default-settings localStorage key outside the browser's own sync flow, and for OWA sessions in which invisible form inputs are created and immediately populated. On the network side, two egress patterns stand out from a mail client's normal behaviour: repeated polling of a public source-code hosting search API on a roughly daily cadence, and DNS queries with the label-length and entropy profile of tunnelled data.

Triage: OWA legitimately reads and writes its own settings keys constantly, so the presence of localStorage activity is not the signal — the discriminator is the specific settings-field path carrying an encrypted blob, and its correlation with a message open. For the server-side artifact the discrimination is cleaner: administrators do grant folder permissions, but they grant them to named users or groups for a specific folder, not Owner rights to the built-in "Default" alias across an entire mailbox. Treat any such grant as compromise until proven otherwise.

Builds on: 2026-07-24/laundry-bear-zimbra-zero-click-cve-2025-66376

Self-hosted webmail is a standing state-espionage battleground — this week a 16-nation advisory exposed Russia's LAUNDRY BEAR Zimbra zero-click and Proofpoint detailed a separate GRU actor's live 'half-click' zero-day supply across five webmail platforms

If you did nothing this week: any internet-reachable self-hosted webmail server in your estate — Zimbra above all, but also SOGo, Roundcube, mDaemon or Kerio — is exposed to at least one Russian state actor running exploits that compromise a mailbox the instant a targeted user simply opens a message, with no link to click and no attachment to open.

Two independent disclosures made webmail the week's espionage story, and they are two different actors. The 16-nation joint advisory AA26-204A attributes a sustained campaign against Zimbra Collaboration Suite to LAUNDRY BEAR (also tracked as Void Blizzard / TA488), and describes its distinguishing tradecraft precisely: the campaign "leverages a view-based exploit that only requires a user to view a malicious email within a vulnerable version of the webmail service" (joint CSA AA26-204A, 2026-07-23), abusing the stored-XSS CVE-2025-66376 to steal 90 days of mail, the Global Address List and 2FA codes (joint CSA AA26-204A, 2026-07-23). Proofpoint's follow-up added the mechanics the advisory omitted, including a CSS-@import sanitizer bypass that reassembles an executing <svg onload="eval(atob('…'))"> and — the part that matters for eviction — the creation of an attacker-controlled application-specific password as a persistence credential separate from the user's own login (Proofpoint, 2026-07-23).

The second actor is TA458 (ESET's Operation RoundPress), which Proofpoint assesses as a likely Russian GRU operation and — importantly — states it "has not observed TA458 using CVE-2025-66376" (Proofpoint, 2026-07-23), keeping the two clusters distinct. TA458 instead runs a standing supply of "half-click" webmail zero-days that fire the instant a target opens a message across Zimbra, mDaemon, Roundcube, Kerio and — newly disclosed this week — SOGo, where Proofpoint reported the flaw to Alinto and it "was patched as CVE-2026-8496 in version 5.12.8" (Proofpoint, 2026-07-23), each dropping a per-client SpyPress payload to steal credentials, contacts and mail. That the same week also brought a routine Zimbra 10.1.20 release fixing an SNMP command-injection RCE and four stored-XSS bugs underlines how continuously this software surface turns over.

Builds on: 2026-07-24/laundry-bear-zimbra-zero-click-cve-2025-66376 · 2026-07-25/laundry-bear-zimreaper-app-password-persistence · 2026-07-25/ta458-roundpress-webmail-zero-days-sogo-cve-2026-8496 · 2026-07-22/zimbra-10-1-20-snmp-command-injection-rce-plus-stored-xss