Russian state hackers are actively exploiting a maximum-severity flaw in Microsoft Exchange Server to backdoor unpatched networks, according to Proofpoint researchers. The attacks are notable less for the vulnerability itself and more for what happens when it is triggered: opening an email is enough to get you compromised, and the resulting backdoor survives both credential rotation and a full disk re-image.
The group behind the campaign, tracked as TA488 and also known as Laundry Bear and Void Blizzard, is using the flaw to steal credentials and sensitive information. Microsoft rated the issue as maximum severity, issued mitigation guidance in May, and shipped a patch in July. The researchers believe the group may have exploited it as a zero-day before the patch was available.
The vulnerability and the half-click problem
The flaw, tracked as CVE-2026-42897, is a cross-site scripting (XSS) vulnerability that stems from a failure to properly filter HTML embedded in email. That makes it a half-click exploit: the victim does not need to click a malicious link or open an attachment. Simply opening the email in an Outlook Web Access (OWA) account is enough to trigger the malicious JavaScript.
Half-click exploits are especially dangerous because they defeat a lot of the user training that defenders rely on. The traditional advice is “do not click suspicious links,” but that guidance does nothing when merely reading a message is the trigger. For an attacker, it removes the uncertainty of whether a target will interact with a lure, which makes supply chain and broad targeting far more reliable.
What OWAReaper does
The JavaScript payload installs a custom-built browser extension that Proofpoint has named OWAReaper. It is, in the researchers’ words, the most sophisticated backdoor they have seen delivered through a half-click exploit, and its purpose is persistent access to the victim’s OWA account.
The persistence angle is the part that should worry defenders. OWAReaper is designed to survive credential rotation and disk re-imaging, which means the standard incident response playbook does not automatically clear it. Rotating passwords and rebuilding a machine are the first two things most teams reach for after a suspected compromise, and this implant is built specifically to ride through both.
The infection chain also shows genuinely improved tradecraft. Proofpoint described the group as doubling down on half-click attacks with improved loading mechanisms and malware, an escalation in both capability and ambition. This is the same group that has recently been tied to a similar campaign exploiting a Zimbra email zero-day, and the NSA warned alongside Proofpoint about the broader pattern last week.
What defenders should do now
For anyone running Exchange Server, the immediate priority is applying the July patch. Microsoft has also provided mitigation guidance and an emergency mitigation service that can offer protection where patching is not immediately possible. Patching is the only complete fix, but the mitigation controls buy time.
A few practical steps are worth taking:
- Patch Exchange Server to the latest supported build as soon as possible, and treat the vulnerability as actively exploited rather than theoretical.
- If a full patch is not immediately possible, apply the Microsoft mitigation guidance and consider the emergency mitigation service for unpatched systems.
- Hunt for signs of OWAReaper or similar browser-based implants, especially on OWA-facing servers that have internet exposure. Persistence that survives re-imaging means looking at the browser extension level, not just the OS.
- Because credential theft is an objective of the campaign, treat any exposed accounts as potentially compromised and plan for rotation that includes the browser-level persistence rather than assuming a password change is sufficient.
The bigger pattern
This campaign fits a worrying trend in state-sponsored activity: attackers moving from network entry to durable, hard-to-clean presence. Exploits that persist inside the browser or the boot chain are far harder to remediate than a simple dropper that gets wiped on restart, and they change the math for incident response.
There is also a reminder here about focus. Exchange Server has been one of the most targeted pieces of internet-facing infrastructure for years, and this campaign shows that is still true. If you run it, it should be treated as high-value attack surface, kept current, and monitored more closely than lower priority systems.
Why attribution and tradecraft matter
The fact that this is attributed to a Kremlin-linked group, rather than generic cybercrime, shapes how organizations should respond. State-sponsored campaigns are typically patient, well resourced, and persistent. They are not looking for a quick payout so much as long-term access and intelligence, which is why the backdoor is built to survive cleanup attempts. Treating it like a typical financially motivated piece of malware undersells the threat.
The tradecraft also matters beyond this single campaign. Proofpoint flagged the improved half-click loading mechanisms as a signal that the group’s capabilities are expanding, and the parallel Zimbra activity shows the technique is not limited to one vendor. Every organization that runs internet-facing email services should assume this attack pattern, email-open compromise with persistent browser implants, is now part of the baseline threat model.
Bottom line
A max-severity XSS flaw in Exchange, exploited as a possible zero-day by a Kremlin-linked group, delivers a browser-based backdoor that survives credential rotation and disk re-imaging. Patching is urgent, mitigation buys time, and incident responders should update their assumptions about what persistence looks like. The half-click era means reading email is no longer automatically safe, and that is worth planning around.