Russian state-backed hackers actively exploiting critical Exchange Server flaw

Russian state-sponsored hackers are actively leveraging a critical flaw in Microsoft Exchange Server to compromise unpatched systems and harvest sensitive data, according to security researchers. The campaign represents an escalation in capability for the group behind the intrusions.

The Attack Campaign#

Threat researchers at Proofpoint have attributed the attacks to TA488, a Kremlin-aligned threat group also known as Laundry Bear and Void Blizzard. The group has shifted its focus to exploiting a cross-site scripting (XSS) vulnerability in Exchange Server's Outlook Web Access (OWA) portal, expanding on previous campaigns targeting other email systems. Unlike typical attacks requiring user interaction, these intrusions succeed through what security experts call "half-click" exploitation—simply opening a malicious email triggers the compromise.

How the Exploit Works#

The vulnerability, designated CVE-2026-42897, stems from inadequate HTML filtering in email messages. This lapse permits malicious JavaScript code to execute within the browser context of affected OWA accounts. Once triggered, the exploit deploys a custom-built backdoor that researchers have named OWAReaper—a JavaScript-based browser extension designed to maintain persistent access to victims' email accounts and systems.

According to Proofpoint, OWAReaper represents the most sophisticated backdoor ever delivered through this style of half-click attack, signaling meaningful improvements in the group's technical capabilities and tactics.

Timeline and Patching Status#

Microsoft provided initial mitigation guidance in May before releasing a full patch in July, assigning the flaw a maximum severity rating. Proofpoint's analysis suggests TA488 may have exploited the vulnerability as a zero-day before Microsoft's fix became available. Organizations running unpatched Exchange servers remain at immediate risk.

Broader Pattern of Escalation#

This campaign builds on earlier activity detailed in a joint advisory from Proofpoint and the National Security Agency. The groups have been systematically exploiting similar "half-click" vulnerabilities across multiple email platforms, including Zimbra mail servers. The shift toward increasingly sophisticated malware and refined delivery mechanisms suggests a deliberate effort by Russian intelligence operatives to improve their operational tradecraft and expand their foothold in target networks.