Two independently-operating Russian state clusters converged this week on the government user's mailbox and the government user's travel — and both leave persistence that a patch or a password reset does not remove
If you did nothing this week: if you run Exchange on premises, a mailbox in your estate may be readable by an actor who no longer needs anyone's password; and if your staff travelled and used hotel or conference Wi-Fi since early May, their session tokens may already be replayable from somewhere else.
The two disclosures are unrelated in operator and identical in target logic. Proofpoint attributed active exploitation of CVE-2026-42897 to LAUNDRY BEAR, describing a flaw where "the server does not adequately sanitize HTML in the message body", allowing "a loader piece of JavaScript to use the onload= event handler to parse the rest of the message body, assemble a Base64 fragment, and execute it as encoded JavaScript" (Proofpoint, 2026-07-29). Opening the message in Outlook Web Access is the whole of the victim interaction. The resulting implant, OWAReaper, is browser-resident with no artifact on the endpoint, and its persistence mechanism is the part that outlasts incident response: it grants the Exchange "Default" alias Owner permission across mail folders, which Proofpoint states plainly means "this persistent access lives on the server-side and requires deliberate removal from the Exchange server; credential rotation and even full re-imaging of the targeted user's device will not evict the actor" (Proofpoint, 2026-07-29). Only on-premises Exchange is in scope, and the permanent fix is the July 2026 Exchange Security Update — which Microsoft notes does not automatically remove the mitigations an administrator applied earlier for the same CVE (Microsoft Exchange Team, 2026-07-14). NCSC Switzerland carried the exploitation to its own constituency on 2026-07-30 (NCSC Switzerland, 2026-07-30).
Microsoft's disclosure moves the same targeting to the travel path. It states that "Microsoft Threat Intelligence assesses that Storm-2945 is an operational sub-cluster of Midnight Blizzard based on distinctive technical and operational overlaps" (Microsoft Threat Intelligence, 2026-07-31). Since early May the cluster has manipulated DNS and HTTP traffic on hospitality networks served by captive portals, answering the browser's own automatic connectivity check with a fake browser or operating-system update prompt — so the lure fires before the user has browsed anywhere. The payloads are built to be difficult to remove and valuable to keep: CornFlake, a Go Windows RAT, "establishes redundant persistence mechanisms: Windows service registrations, Registry Run keys, named scheduled tasks, and a persistence watchdog routine that runs continuously to restore any persistence mechanism that is removed by defenders or endpoint protection" (Microsoft Threat Intelligence, 2026-07-31), while ChocoShell, an in-memory PowerShell stealer, "collects Microsoft 365 and Azure Active Directory (AD) access tokens, refresh tokens, and Web Account Manager (WAM) tokens from .tbres files in the Token Broker cache", which Microsoft assesses lets actors "replay SSO sessions without browser cookies" (Microsoft Threat Intelligence, 2026-07-31). Independent research into the same tradecraft class found compromised Wi-Fi gateways "across multiple US cities and internationally in India and Saudi Arabia, primarily in hotel and hospitality organizations" (ReliaQuest, 2026-07-23).
The identity layer is where the two paths rejoin, and where a third in-window development sharpens the picture: some CaptiveCrunch landing pages have driven users into the Entra ID device-code authentication flow since 16 July (Microsoft Threat Intelligence, 2026-07-31), the same flow a separate criminal operation ran a fresh wave of this week from commercially-trusted hosting infrastructure. A stolen refresh or WAM token and a mailbox-folder permission grant have the same property: both are authorisations rather than credentials, so the standard incident response of resetting the password and rebuilding the laptop closes neither.
Triage: the OWA case produces no endpoint artifact at all, so process-level telemetry will be silent; the signal is server-side, in mailbox-permission change events granting rights to the "Default" alias and in add-in or OAuth grants appearing on accounts that never installed one. For the travel case, the discriminator is sequence and location rather than the update prompt itself — a browser or OS update package fetched moments after a device associated with a new wireless network, from a host that is not the vendor's update infrastructure, with the connectivity-check request immediately preceding it. The lure's mechanics give a second, sharper signal: these are paste-and-run instructions, so Microsoft's own guidance is to teach users to recognise ClickFix-style prompts and fake verification checks "especially when they invoke command interpreters or script hosts such as cmd.exe, PowerShell, rundll32.exe, or mshta.exe" (Microsoft Threat Intelligence, 2026-07-31) — so a script host spawned from a browser process shortly after a captive-portal association is the process-lineage version of the same test. On the collection side, CornFlake carries a ChromeKatz-derived module doing live cookie extraction from Chromium process memory and stored-password extraction from on-disk databases, including an App-Bound Encryption bypass and Firefox NSS decryption (Microsoft Threat Intelligence, 2026-07-31); a non-browser process reading a browser's credential store or its live memory is the detectable artifact, and it sits alongside the token theft rather than replacing it. On the identity side, a successful sign-in whose token was minted through the device-code flow for a user whose role never requires it, or an SSO session replayed from an address class inconsistent with the user's own context, is the shape both clusters ultimately produce.
The messages exploit CVE-2026-42897, a vulnerability in Outlook Web Access in which the server does not adequately sanitize HTML in the message body. This allows a loader piece of JavaScript to use the onload= event handler to parse the rest of the message body, assemble a Base64 fragment, and execute it as encoded JavaScript.
This persistent access lives on the server-side and requires deliberate removal from the Exchange server; credential rotation and even full re-imaging of the targeted user's device will not evict the actor.
Microsoft Threat Intelligence assesses that Storm-2945 is an operational sub-cluster of Midnight Blizzard based on distinctive technical and operational overlaps.
It establishes redundant persistence mechanisms: Windows service registrations, Registry Run keys, named scheduled tasks, and a persistence watchdog routine that runs continuously to restore any persistence mechanism that is removed by defenders or endpoint protection.
Additionally, ChocoShell collects Microsoft 365 and Azure Active Directory (AD) access tokens, refresh tokens, and Web Account Manager (WAM) tokens from .tbres files in the Token Broker cache. Collection of these tokens represents a significant threat to enterprise environments, as threat actors could replay SSO sessions without browser cookies.
ATT&CK mapping
11 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1566Phishing
Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.
Execution TA0002
T1053.005Scheduled Task/Job: Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.
T1203Exploitation for Client Execution
Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
T1204.004User Execution: Malicious Copy and Paste
An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is "ClickFix," in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code.
Persistence TA0003
T1053.005Scheduled Task/Job: Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.
T1098.002Account Manipulation: Additional Email Delegate Permissions
Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account.
T1543.003Create or Modify System Process: Windows Service
Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Privilege Escalation TA0004
T1053.005Scheduled Task/Job: Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.
T1098.002Account Manipulation: Additional Email Delegate Permissions
Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account.
T1543.003Create or Modify System Process: Windows Service
Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Credential Access TA0006
T1528Steal Application Access Token
Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.
T1539Steal Web Session Cookie
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.
T1557Adversary-in-the-Middle
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.
Lateral Movement TA0008
T1550.001Use Alternate Authentication Material: Application Access Token
Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.
Collection TA0009
T1185Browser Session Hijacking
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
T1557Adversary-in-the-Middle
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.