owa

The Russian threat actors recently linked to the exploitation of a now-patched vulnerability in Zimbra have been observed exploiting another vulnerability, this time in Microsoft Outlook Web Access (OWA), to target U.S. and European government entities, as well as the telecommunications, financial, hospitality, and aerospace sectors. The activity, which began on July 22, 2026, involves the weaponization of CVE-2026-42897 (CVSS score: 8.1), a cross-site scripting (XSS) vulnerability in OWA. It was flagged by Microsoft as having been exploited in attacks as far back as May 2026. Enterprise security company Proofpoint has attributed the activity to Laundry Bear (aka CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard), which was recently attributed to the zero-day exploitation of CVE-2025-66376, an XSS flaw in Zimbra's Classic UI, since at least July 2025 before it was patched four months later. In these attacks, the threat actors sent out messages from adversary-controlled Proton Mail accounts and from previously compromised addresses that triggered an exploit for CVE-2025-66376 as soon as the emails were viewed via a vulnerable version of Zimbra, ultimately resulting in the deployment of a JavaScript payload dubbed ZimReaper that's capable of harvesting 90 days of the victim's mail and other valuable data. "TA488 is doubling down on the use of 'half-click' exploits - where opening the email is enough to trigger compromise - with significantly improved loading mechanisms, techniques, and malware, signaling an improvement in the group's tradecraft and capability," Proofpoint researchers Greg Lesnewich, Stuart Del Caliz, Nick Attfield, Konstantin Klinger, Saher Naumaan, and Mark Kelly said. Like before, the activity relies on compromised accounts to send emails exploiting the flaw. The volume of the phishing messages and breadth of targeting is a departure from prior TA488 campaigns and is assessed to be an intentionally broad effort to blend in with mass-mailing spam and fly under the radar. The emails themselves feature vague message lures with no action required on the part of the recipient. The messages have been found to mimic informational emails on topics such as supply chain analyses, research updates, and metrics for tourism or gas markets. The use of such generic emails is once again a consistent hallmark in the threat actor's half-click exploit chains, as the idea here is to lend them an illusion of legitimacy and not arouse a victim's suspicion by purposefully excluding any URLs or attachments. In doing so, the likelihood that a recipient opens and reads the message increases, effectively firing the exploit for CVE-2026-42897 in the process. "This allows a loader piece of JavaScript to use the onload= event handler to parse the rest of the message body, assemble a Base64 fragment, and execute it as encoded JavaScript," Proofpoint explained. "The initial exploit trigger and relevant payload blobs are stored in the social media icons shown in the message body HTML. The next-stage payload data is stored after # symbols, which the browser stops at when parsing images from Base64." The new wave of exploitation revolving around CVE-2026-42897 culminates with the deployment of a previously unknown JavaScript browser-based implant codenamed OWAReaper that's specifically built for persistent access within Microsoft's webmail client. Described as the most sophisticated backdoor delivered via half-click exploits, the malware is an evolution of ZimReaper, while sharing significant source code and behavioral overlaps. It's executed within the OWA reading pane. Once executed, it uses Outlook APIs to rewrite the email on the Exchange server and remove the exploit content. In tandem, the malware takes steps to disable OWA pop-ups and the ability to right-click during its run. It also creates a session key that's unique to the target, before proceeding to gather the target's email address, username, and Outlook settings. It then creates two invisible input elements in the web page's Document Object Model (DOM) so as to capture the victim's OWA saved credentials via the browser's autofill feature. The next step entails writing an encrypted version of itself and a decryption wrapper into the browser's localStorage. This, in turn, causes the malware to be automatically executed every time an unsuspecting user opens an OWA tab in the browser. OWAReaper checks for installed Outlook add-ins with ReadWriteMailbox permissions, and, if found, uses them to steal OAuth tokens, and grants itself Owner-level permissions to the Default user on every mail folder. This process grants complete mailbox access to any authenticated user in the same organization. "This is a key aspect of the infection chain; if TA488 has access to other accounts in the organization, the group maintains persistent access to the target's mailbox," the researchers pointed out. "This persistent access lives on the server-side and requires deliberate removal from the Exchange server; credential rotation and even full re-imaging of the targeted user's device will not evict the actor." Furthermore, the malware creates a second persistence method by adding a hidden iframe element to messages stored in OWA's offline IndexedDB message cache and enabling caching. The iframe is executed each time the victim opens a malicious email from the cache, thereby re-infecting the target even after a host is re-imaged. OWAReaper is also notable for employing two methods for command-and-control (C&C or C2): using GitHub or attacker-sent emails to parse commands and execute them on the host. The script queries GitHub's Commit Search API every 24 hours for commit messages containing the target's email address. If it finds one, the data is parsed and decrypted using a hard-coded key from the JavaScript and a per-session AES key, likely in an attempt to prevent other parties from extracting the commands. The decoded data contains a four-character header that denotes a specific command type - code, to replace OWAReaper's entire toolkit code domn, to rotate the C&C servers cmnd, to execute arbitrary JavaScript code via eval() Alternatively, OWAReaper can parse inbound emails sent from TA488 operators to process and run the same types of commands observed in the GitHub method. It checks the IndexedDB for message bodies with the {target_email_address}{space}{Base64text} structure. Data exfiltration is accomplished primarily over HTTPS with AES-CTR encrypted URI paths. Should this approach fail, the malware uses DNS label tunneling to smuggle data within standard DNS queries of an actor-controlled domain. Proofpoint noted that the earliest infrastructure used in this campaign was created in March 2026, two months before Microsoft disclosed CVE-2026-42897, raising the possibility that it may have been exploited as a zero-day. The company also said it did not detect any activity from TA488 between February and July 22, 2026. "OWAReaper runs inside the OWA browser context, operating as a stealthy implant with no host footprint, using two C&C communication channels and two data exfiltration protocols," Proofpoint said. "It is capable of surviving browser reboots, credential rotation, and full re-imaging of the victim's device." "Based on newly observed activity, TA488 appears to demonstrate interest in a wide range of sectors while maintaining priorities for intelligence collection against government and defense. Lure themes remain generic and unremarkable, so the target is more inclined to open and skim the email but ultimately overlook it."

The Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is exploiting an Exchange Outlook Web Access vulnerability in email campaigns to deliver a sophisticated backdoor called OWAReaper. Email security company Proofpoint spotted the activity a week ago targeting various organizations, including government entities in the U.S. and Europe, and companies in the telecommunications, financial, hospitality, and aerospace sectors. Laundry Bear exploited CVE-2026-42897, a cross-site scripting (XSS) vulnerability that allows executing arbitrary JavaScript in the browser context when users open a specially crafted email in the Outlook Web Access (OWA) app. Previously, the same hackers leveraged another XSS vulnerability (CVE-2025-66376) as a zero-day in Zimbra email servers to deliver malware ZimReaper that steals email communication, two-factor authentication (2FA) codes, application passcodes, and passwords. Proofpoint researchers refer to this sort of XSS activity on webmail platforms as a “half-click exploit” because users only need to open the malicious email to trigger the exploited vulnerability. Improper HTML sanitization In a new report today, Proofpoint describes Laundry Bear’s new half-click exploit campaign as a significant “improvement in the group’s tradecraft and capability.” Based on Microsoft’s advisory on May 14 for the CVE-2026-42897 flaw in OWA, the threat actor was already exploiting it as a zero-day. The security issue causes the server to improperly sanitize the HTML code in the message body, which could be leveraged to run JavaScript when opening the email. According to Proofpoint, Laundry Bear, which the company tracks as TA488, had created the attack infrastructure for the OWAReaper campaign in March, almost two months before Microsoft’s warning. In the latest observed activity, the threat actor used messages on topics of interest to the target, such as supply-chain analyses, research updates, and performance indicators for tourism and gas markets. “The subject lines and lures are banal, likely so the targeted user opens and skims the message, but dismisses the message as junk without reporting it, especially given that there are no suspicious URLs or attachments present.” Proofpoint explains that the attacker leverages the improper sanitization issue to include malicious code in the messages to add HTML and JavaScript in the malicious messages. Emails contained a JavaScript loader and Base64-encoded payload blobs embedded in social media icon URLs after the ‘#’ character. The exploit delivers a backdoor that researchers call OWAReaper and describe as “the most sophisticated backdoor delivered via half-click exploits” they saw. Analysis revealed a “suite of subtle persistence mechanisms” and revealed it to be an evolution of the ZimReaper malware observed in the attacks against Zimbra email servers. “OWAReaper is executed entirely in the Outlook Web Access (OWA) reading pane. Upon execution, it uses Outlook APIs to rewrite the email on the Exchange server and remove the exploit content. Simultaneously, it disables OWA pop-ups and right-click ability while it runs,” Proofpoint says. The malware collects the compromised account’s email address, username, and Outlook settings. It also tries to steal the access credentials by creating invisible elements in the Document Object Model (DOM) and waiting for the browser to automatically fill them in. Long-term persistence mechanism Proofpoint researchers discovered that TA488 (Laundry Bear, Void Blizzard) can maintain access to a target’s mailbox even if their system is restored from a clean image or credentials are rotated. The threat actor achieves this through OWAReaper, which checks for installed Outlook add-ins that have ReadWriteMailbox permissions and uses them to steal OAuth tokens through the GetClientAccessToken operation request. “It then calls UpdateFolder to grant itself Owner-level permissions to the 'Default’ user (a low-permission preset alias in all Microsoft Exchange tenants) on every mail folder,” the researchers explain. This allows attackers to access the mailbox from any authenticated account within the organization. Because mailbox permissions are configured on the server side, changing the compromised user's credentials or reinstalling the affected system does not revoke the attackers' access. OWAReaper implements a second persistence mechanism by enabling caching and injecting a malicious iframe in the HTML of messages stored in OWA's offline IndexedDB. “This iframe executes every time the victim opens a poisoned email from the cache,” the researchers say. Two of everything The malware supports two command-and-control (C2) mechanisms for receiving instructions from the attacker. One of them uses GitHub commit messages as the communication channel. Every 24 hours, the malware queries GitHub's Commit Search API for encrypted messages that match a specific format and include the target's email address. OWAReaper can also parse emails delivered to the target’s mailbox. It checks the IndexedDB for message bodies with the {target_email_address}{space}{Base64text} structure. Laundry Bear also used two methods to exfiltrate data, the main one using HTTPS with AES-CTR encrypted URI paths that would be proxied through certain image content delivery network (CDN) domains. If the primary method fails, the data is delivered directly to the attacker’s server, which is defined in the function that initializes outbound network sessions. There is also a DNS exfiltration fallback, where data is encrypted, then encoded in packets using the Base32 method. Proofpoint attributed the OWAReaper campaign to the TA488 threat actor based on behavioral overlaps with the ZimReaper activity and the use of half-click XSS exploits to target webmail viewers for espionage purposes. The researchers published a small set of indicators of compromise (IoCs) that includes the domains used and the HTML message body with the CVE-2026-42897 exploit and the OWAReaper payload. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A Russia-aligned espionage group has resurfaced after months without observed activity, using a half-click exploit against on-premises Outlook Web Access (OWA) to plant a browser-resident implant and establish server-side persistence that can survive credential rotation and device re-imaging. According to new research from Proofpoint published on July 29, TA488, also tracked as Void Blizzard and Laundry Bear, began the campaign on July 22, one day before the company's joint advisory with the NSA and partner agencies on the group's earlier Zimbra activity. It had not been seen since February. Targets spanned US and European government entities plus the telecommunications, financial, hospitality and aerospace sectors. The volume was unusual for the group, which Proofpoint suggested may have been deliberate to blend into mass-mailing spam. Banal Lures, No Clicks Required The messages exploited CVE-2026-42897, a cross-site scripting flaw affecting on-premises Exchange Server, not Exchange Online. Opening the email in a vulnerable OWA client caused the victim's browser to execute the embedded JavaScript within their authenticated session. Lures were deliberately unremarkable, with subject lines covering semiconductor supply chains, gas markets and tourism metrics. Proofpoint said the banality was likely deliberate, so the recipient opened and skimmed the message, then dismissed it as junk without reporting it, leaving no suspicious links or attachments to flag. Persistence That Outlives the Device The payload was OWAReaper, a previously unknown JavaScript implant Proofpoint called the most sophisticated half-click backdoor it has seen. It built on ZimReaper from the group's Zimbra campaigns, dropping that tool's mass email exfiltration. OWAReaper ran entirely in the OWA reading pane with no conventional file on disk. It rewrote the original email on the server to strip the exploit, harvested saved credentials, then hid an encrypted copy of itself in browser localStorage under a legitimate OWA settings key, so every new tab re-executed it. Its most durable mechanism was server-side: where add-ins with mailbox write permissions existed, it stole OAuth tokens and granted Exchange's low-privilege Default user Owner-level permissions on every mail folder, opening the mailbox to any authenticated account in the organization. It also planted a hidden iframe in messages held in OWA's offline IndexedDB cache, which re-infected the target even after the host was re-imaged. Because the folder-permission grant lived server-side and required deliberate removal from Exchange, credential rotation and re-imaging did not evict the actor. Two Command Channels, Two Exfiltration Routes Commands arrived via GitHub commit messages, queried daily, or inbound emails polled every five minutes. Exfiltration occurred over HTTPS, proxied through legitimate image content delivery networks, with a fallback to DNS tunneling. The campaign's infrastructure dates to March 2026, roughly two months before Microsoft disclosed the flaw, making zero-day use feasible, though registration dates alone don't confirm when exploitation began. Microsoft has since released Exchange security updates addressing the flaw. Beyond patching, Proofpoint urged defenders to revoke Exchange Web Services tokens, strip Default-user folder grants and clear OWA's offline database and localStorage key.

Although experts had already warned of an impending “tsunami of vulnerabilities” back in April, immediately following the announcement of the Mythos AI model, concrete evidence began to emerge over the summer. June’s Patch Tuesday was massive and, at the time, a record-breaker (around 200 CVEs), and right before that, hundreds of fixes were released for Chromium-based browsers, including Chrome and Microsoft Edge. But July revealed this new trend in all its glory. Yesterday’s Patch Tuesday addressed 570 vulnerabilities in Microsoft products, and if we are including the “platform-level” patches that Microsoft applies to its own servers, the total rises to 620. And that’s not even counting the 470 vulnerabilities in Chromium. In just six months, Redmond has already fixed more defects than in any previous year over the past 20 years of observation. Depending on which products are included in the final figures, the number of CVEs may vary slightly; various experts cite figures of 569, 570, 621, 622 — but anyway this figure is three times higher than the previous update package and five to 10 times higher than last year’s typical figures for monthly update. The fixed vulnerabilities are broken down by category as follows: 254 — elevation of privilege (EoP), 145 — remote code execution (RCE), 102 — information disclosure, 35 — denial of service (DoS), 17 — security feature bypass, and 16 — information spoofing. EoP vulnerabilities accounted for nearly 44% of the release, while RCE vulnerabilities accounted for a quarter. Rapid7 experts separately note 416 bugs in Windows itself (also a record), and the fact that the release notes no longer list CVEs individually. Instead, there is a summary table organized by product families and a new section titled “Notable CVEs”. Incidentally, in that section, Microsoft managed to list CVE-2026-56155 twice instead of another zero-day vulnerability. This brevity is partly due to the fact that the update package affects a very broad range of products. Even very old, rarely used components — such as MIDI drivers — have been updated, as well as games, including Age of Empires II (CVE-2026-50663) and Minecraft Bedrock Dedicated Server, where the high-impact CVE-2026-55010 (CVSS 9.8) was found — a heap overflow leading to RCE without authentication. Of the entire set, only three vulnerabilities are classified as zero-day, and 59 have been rated critical. Among the critical vulnerabilities, 48 can lead to RCE, nine to privilege escalation, one to security feature bypass, and one allows spoofing. Vulnerabilities exploited in real-world attacks or known prior to the patch CVE-2026-56155 (CVSS 7.8) — privilege escalation in Active Directory Federation Services. Due to access control flaws, a user with low local privileges can elevate them to administrator level. No details are provided about attacks exploiting this vulnerability, but the description acknowledges the effort of Microsoft DART staff — the incident response team. The vulnerability has already been added to the CISA KEV catalog. CVE-2026-56164 (CVSS 5.3) — privilege escalation via Microsoft SharePoint Server: a lack of authentication for a critical function. The attack complexity for exploiting this vulnerability is low; no authentication or user interaction is required, and Microsoft explicitly states that an attacker doesn’t need in-depth knowledge of the system. Affected versions include SharePoint Enterprise Server 2016, Server 2019, and the Subscription Edition. Credit for the discovery goes to experts at Mandiant Incident Response, Google Cloud, FLARE OTF, and an anonymous contributor — the acknowledgments list once again reads like a breakdown of an active incident, and not just a single one. Until the patch is installed, enabling AMSI with Request Body Scan set to Full can help, but this is a temporary measure, not a substitute for the update. CVE-2026-56164 has also already been added to CISA’s KEV. The third zero-day vulnerability has “merely” been disclosed prior to remediation; there are no reports of it being exploited in attacks. However, this is due to the nature of the vulnerability — we’re dealing with yet another BitLocker bypass — CVE-2026-50661 (CVSS 6.1) — therefore exploitation requires physical access to the machine. Microsoft considers exploitation unlikely, and authorship is attributed to an “anonymous” individual. Presumably, the patch addresses GreatXML — a BitLocker bypass that a researcher going by the nickname Chaotic Eclipse (Nightmare Eclipse) published on June 10, the day after June’s Patch Tuesday. Laptops and any devices that leave the corporate perimeter should be patched as a priority. Critical vulnerabilities in July’s Patch Tuesday There are many critical vulnerabilities, so we’ll highlight only the most urgent ones. In our list, the CVSS score never drops below 9.6. CVE-2026-57092 (CVSS 9.9) — EoP in VMSwitch, allows escape from an isolated environment with full host compromise. A use-after-free vulnerability that allows a low-privileged attacker to cross the virtual machine boundary and gain access to the host. ZDI notes that a similar exploit was demonstrated at Pwn2Own Berlin on ESXi. Hyper-V users need to update VMSwitch today. CVE-2026-56190 (CVSS 9.8) — RCE in RDP, unauthenticated, network-based, no user interaction required. Those with RDP servers accessible via the internet are at critical risk; such configurations are practically unsustainable in 2026. CVE-2026-50518 (CVSS 9.8) — RCE in the DHCP server: heap overflow, unauthenticated, network-based. And this isn’t the only problem with the DHCP server. In this release, it also contains CVE-2026-50370, -56159, and -48564, while the DHCP client contains CVE-2026-54128. CVE-2026-50522 and CVE-2026-58644 (both CVSS 9.8) — a pair of RCE vulnerabilities in SharePoint servers: deserialization of untrusted data, unauthenticated, and without user interaction. Although Microsoft describes the exploit’s reliability as “unproven”, this is, to put it mildly, untrue. For CVE-2026-50522, a working exploit was demonstrated at Pwn2Own Berlin. In the same group is CVE-2026-55040 (CVSS 9.1), an authentication bypass discovered by Rapid7 experts. Exploiting this vulnerability is the first link in the attack chain; the second is currently under embargo and will be disclosed (and patched) in August Patch Tuesday. Together, they enable RCE without authentication. Meanwhile, the July Patch Tuesday marks the end of support for SharePoint Server 2016 and 2019. CVE-2026-56188 (CVSS 9.8) — RCE in the Windows Server network driver. The exploitation is highly complex (TOCTOU), but if successful, this vulnerability allows privileged code to be executed over the network without user interaction — in other words, it enables the creation of network worms. CVE-2026-55008 (CVSS 9.6) — spoofing in Exchange Server (it’s unclear why this is called spoofing, as the description explicitly states “XSS”). An attacker sends a specially crafted email; the victim simply opens it in OWA — and arbitrary JavaScript is executed in their session. The reason behind the “tsunami” and how to deal with it If such patch releases become the norm, without a radical overhaul and automation of vulnerability management processes, security and IT teams will have nothing to do but apply updates. There are indications that this is the new normal, and the tsunami could last for many months — possibly years. At Microsoft, the reason is called MDASH — multi-model agentic scanning harness. A few days before the release, Microsoft officially acknowledged that its AI-powered vulnerability scanning system is actively analyzing critical Windows components, and warned customers that the volume of updates in each release will only increase. That said, Redmond is not alone; Adobe and Cisco, for example, have recently announced an increase in the frequency of their updates. So how can an organization adapt its processes and technologies to this pace and volume of updates? Automate in-depth host scanning, maintain a list of priority patches, install applicable updates, and verify that vulnerabilities are actually patched. With 500+ defects per month, manually transferring tickets from the scanner to a task tracker or launching update tasks simply isn’t possible. Prioritize efforts effectively. It’s nearly impossible to address a release of this magnitude in its entirety all at once, so a process that takes into account the severity of vulnerabilities, the likelihood of them being exploited in the company’s infrastructure, and the business impact becomes absolutely essential. Set up organizational processes. Technically, a patch can often be applied in minutes, but the approval process can take weeks as it makes its way through various departments, as can the process of initiating and managing that approval. Vulnerability management must be tied to an approval process that is as short, simple, and automatically documented as possible. If a decision regarding a specific vulnerability requires setting aside a maintenance window and obtaining approval from an entire committee, the process must be given high priority by that committee. Otherwise, by the time the patch is installed, Microsoft will have released the next 600 vulnerabilities.

Microsoft has announced plans to disable Outlook Web Access (OWA) Light, the lightweight version of the Outlook Web App email client, in a future Exchange Server update. "OWA Light was an important compatibility experience when the web needed it. Today, the full Outlook on the web experience is the right place for us to focus," the Exchange Team said on Wednesday. "Retiring OWA Light will help reduce legacy surface area, simplify ongoing engineering work, and allow us to continue improving the experience customers use every day." Microsoft introduced OWA Light roughly two decades ago as an alternative to OWA Premium, offering a simplified web interface for systems that didn't have Internet Explorer 6 or later installed or ran older web browsers. At the time, the company said that OWA Light offered a cleaner look, faster logon times on low-bandwidth Internet connections, and worked in locked-down browser modes (such as kiosks). However, OWA Light has a limited set of features compared to the standard version (which offers full functionality), including the lack of weekly or monthly calendar views, access to shared mailboxes or shared calendars, the ability to import or export messages or contacts, and the ability to create or modify tasks or notes. Microsoft deprecated OWA Light as of August 19, 2024, and announced this week that the OWA Light experience will likely be removed from Exchange Server (on-premises) next month. "The web has changed significantly since OWA Light was introduced. Modern browsers are more capable and more consistent, network conditions have improved for many customers, and security landscape has changed significantly," Microsoft added. "In an upcoming Exchange Server update (estimated in August 2026), we plan to disable and remove the OWA Light experience. After that change is introduced, users will no longer be able to choose or be redirected to OWA Light and should use the modern Outlook on the web experience instead." Admins can also block OWA Light right away using the "Set-OwaMailboxPolicy -OwaLightEnabled $false" command and disable the OWA Light selection menu on the logon page by running "Set-OwaVirtualDirectory -LogonPageLightSelectionEnabled $false". Microsoft provides further information on how to disable or block OWA Light in the Set-OwaMailboxPolicy and Set-OwaVirtualDirectory documentation. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Microsoft��Exchange��OWA�ɉe������d�v�Ǝ㐫�����\�ACISA�����p���m�F�����B�����z�M�����ɘa��̊m�F���@���Ԍ����菇���������B�܂��A�K�p��ɃJ�����_�[�����摜�\�����s�S�ɂȂ���m�̕s��̉����A�P�v�p�b��̔z�M�������܂Ƃ߂�B ���̋L������������ł��B����o�^����ƑS�Ă������������܂��B �@Microsoft��2026�N5��14���i���n���ԁj�A�uMicrosoft Exchange Server�v�ɑ��݂���Ǝ�i�������Ⴍ�j���uCVE-2026-42897�v�����\�����BExchange Server 2016�AExchange Server 2019�AExchange Server Subscription Edition�iSE�j���Ώۂ��B �@�uExchange Outlook Web Access�v�iOWA�j�o�R�ōH�ς݃��[�����J�����ꍇ�A�����������Web�u���E�U���֔C��JavaScript�𑗂荞�܂�鋰�ꂪ����B�uMicrosoft Exchange Online�v�ɂ͉e���͋y�Ȃ��B �@�{�Ǝ㐫�����p���ꂽ�ꍇ�A�U���҂��瑗�M���ꂽ�H�ς݃��[���𗘗p�҂�OWA�ʼn{�����A����̑��삪���ꂽ�i�K�ŕs����JavaScript�����s�����BMicrosoft�͊��Ɋɘa������J���Ă���A�P�v�Ή��̂��߂̃Z�L�����e�B�X�V�v���O���������������Ƃ����B �@��Ƃ���Microsoft�́AExchange Emergency Mitigation Service�iEM Service�j�̗��p�𐄏����Ă���B���@�\��2021�N9���������Ă���A����ŗL��������Ă��邽�߁A�L���Ȋ��ł������̊ɘa��i���ʎq�F�uM2.1.x�v�j�������I�ɔz�M�����B�Ǘ��҂́A���������uViewing Applied Mitigations�v�ɋL�ڂ��ꂽ�菇�A�܂��̓X�N���v�g�c�[���uExchange Health Checker�v�����s���邱�ƂŁA�ɘa��̓K�p���m�F�ł���B �@EM Service����~���Ă�����ɑ��ẮA���₩�ɋ@�\��L��������悤�����Ă���B�܂��A2023�N3���ȑO�̃o�[�W�����i�r���h�j��Exchange Server�𗘗p���Ă���ꍇ�A�V�����ɘa����m�F����@�\�͗��p�ł��Ȃ��_�����������B �@EM Service�𗘗p�ł��Ȃ��������̎菇�����Ă���B�Ώۂ͕�Ԃ�u�����ȂǂŁA�Ǘ��҂��ŐV��Exchange On-premises Mitigation Tool�iEOMT�j���擾���AExchange Management Shell�ォ��X�N���v�g�����s�����ƂȂ�B���̎�@�́A�P��T�[�o�P�ʂł̓K�p�ƁA�S�T�[�o�ւ̈ꊇ�K�p�̗������ɑΉ����Ă���B �@����̊ɘa���K�p������ɁA����̕s�������Ă���BOWA�̃J�����_�[����@�\�̓���s�S��A��M�ґ�OWA�̉{����ʂɂ�����C�����C���摜�̕\���ُ�A�uOWA light�i�ȈՔŁj�v�̓���s�S�Ȃǂ��܂܂��BMicrosoft�͑�֎�i�Ƃ��āAOutlook�f�X�N�g�b�v�A�v���̗��p��A�摜���C�����C���ł͂Ȃ��Y�t�t�@�C������ő���M���邱�ƂȂǂ��ē����Ă���B �@�Ď��@�\�ւ̉e�����m�F����Ă���B�uOWACalendar.Proxy healthset�v���ُ��Ԃɕω����邽�߁A�Ď����i���Ōx������������ꍇ������B����ɑ�Microsoft�́A�P�v�I�ȏC���ł����J�����܂ł́A�Ď���Ց��ł��̌x�����ꎞ�I�ɖ�������^�p�𐄏������B �@����ɁA�ɘa��̏ڍ�ʂɁuMitigation invalid for this exchange version.�v�Ƃ����G���[���\������鎖�������Ă��邪�A�X�e�[�^�X�����uApplied�v�ɂȂ��Ă���Ίɘa�̂͐���ɓK�p����Ă���Ƃ����BMicrosoft�́A���̕\����̕s��̉������@�ɂ��Ă����ݒ��������B �@�P�v��ƂȂ�Z�L�����e�B�X�V�v���O�����̔z�M�v������炩�ɂȂ����B�ΏۂƂȂ�o�[�W�����́AExchange SE RTM�AExchange 2016 CU23�AExchange Server 2019 CU14�ACU15���BMicrosoft�́A�������Â�CU�i�ݐύX�V�v���O�����j�𗘗p���Ă����Ƃɑ��A���₩�ɃA�b�v�f�[�g�����{����悤���߂Ă���B �@�������A�X�V�v���O�����̔z�M�����ɂ͍��ق����݂���BExchange SE�p�̍X�V�v���O�����͈�ʌ��J����Œ���邪�AExchange 2016�����2019�p�̍X�V�v���O�������擾����ɂ́A�uPeriod 2 Exchange Server 2016/2019 ESU�i�g���Z�L�����e�B�X�V�j�v���O�����v�ւ̉������K�v�ƂȂ�BPeriod 1�̌���_��݂̂�����ł��闘�p�҂ɂ͍X�V�v���O����������Ȃ��B�Ȃ��A�����x�iPeriod 1�j��2026�N4���ɏI�����Ă���B �@�č��y���S�ۏ�ȃT�C�o�[�Z�L�����e�B�E�C���t���X�g���N�`���Z�L�����e�B���iCISA�j�́A�{�Ǝ㐫���uKEV�i���m�̈��p���ꂽ�Ǝ㐫�j�J�^���O�v�ɒlj������BCISA�́A���ۂɈ��p�̎����i�؋��j���m�F�������Ƃ𗝗R�ɋ����A���̎�̐Ǝ㐫���U���҂ɂƂ��Ď�v�ȐN���o�H�ɂȂ蓾��Ǝw�E�B���{�@�ֈȊO�̑g�D�ɑ��Ă��A�v���ȏC���Ή��𑣂��Ă���B�Ǝ㐫�Ǘ��̍H���ɂ����āAKEV�J�^���O�Ɏ��^���ꂽ�Č���D��I�ɏ������邱�Ƃ��A�T�C�o�[�U���ɂ���Q�̒ጸ�ɒ�������Ɛ��������B Copyright © ITmedia, Inc. All Rights Reserved.

CVE-2026-42897 stems from a cross-site scripting (XSS) vulnerability and can allow an attacker to compromise Outlook Web Access (OWA) mailboxes.

Microsoft is investigating several issues causing email synchronization and connection problems when using the classic Outlook desktop client. The first bug causes "Can't connect to the server" errors when creating groups in classic Outlook when Exchange Web Services (EWS) is enabled for the tenant. According to Microsoft, this occurs because the AD Graph call for ValidateUnifiedGroupProperties fails with the following error: "An internal server error occurred. The operation failed. Both AAD and MSGraph clients are null or AAD Graph is disabled for this API." "The Outlook Team is working to release updated group functionality that uses REST APIs which will address this issue. We will update this topic as soon as we know the REST release specifics," Microsoft said in a recently published support document. Until a fix is available, Microsoft advises affected users to create and edit groups using the new Outlook client or Outlook Web Access (OWA). The other known issue is triggering 0x800CCC0F and 0x80070057 when synchronizing Gmail and Yahoo accounts in classic Outlook. "After changing your Gmail or Yahoo account passwords in classic Outlook you are not prompted to sign in. There might be other circumstances that lead to this same issue that we are investigating," Microsoft said. The Outlook team is working to identify the root cause of this known issue and will share more details once a fix is available. Until then, customers are advised to work around the sync problems by deleting the registry entries for the affected email address under the Identities key at Computer\HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity\Identities in the Windows Registry Editor. Microsoft is also investigating a classic Outlook bug, acknowledged almost two months after the first reports surfaced online, that causes the mouse pointer to disappear for some users. The same issue also affects some users of OneNote and other Microsoft 365 apps. Redmond has asked affected customers to open a support case with the Outlook Support Team through their Microsoft 365 admin and submit diagnostic log files to assist the Outlook team with analysis. As temporary workarounds, affected users can click an email in the message list when the cursor disappears, which may cause it to reappear, or switch to PowerPoint, click into an editable area, and then return to Outlook, which may also restore the mouse pointer. If neither of them works, Microsoft said that restarting the impacted computer should also resolve the issue temporarily. In January, Microsoft addressed another classic Outlook issue caused by the December 2025 updates that prevented Microsoft 365 customers from opening encrypted emails. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Russian state-sponsored group APT28 has been targeting organizations associated with energy research, defense collaboration, and government communication in a new credential-harvesting campaign, Recorded Future reports. Active since at least 2004 and also known as BlueDelta, Fancy Bear, Forest Blizzard, Sednit, and Sofacy, APT28 has been linked to the Russian General Staff Main Intelligence Directorate (GRU). The hacking group is known for targeting energy, government, military, and media entities in the US and Europe, and was blamed last year for targeting the TV5Monde broadcasting station, and for exploiting mail servers since September 2023. Last year, an APT28 credential harvesting activity targeted people associated with a Turkish energy and nuclear research agency and a European think tank, as well as entities in North Macedonia and Uzbekistan. As part of the attacks, the threat actor used phishing pages impersonating Microsoft Outlook Web Access (OWA), Google, and Sophos VPN portals. After entering their credentials, the victims were redirected to the legitimate domains. “The campaigns relied heavily on free hosting and tunneling services, such as Webhook[.]site, InfinityFree, Byet Internet Services, and Ngrok, to host phishing content, capture user data, and manage redirections,” Recorded Future explains. In February 2025, APT28 deployed a Microsoft OWA phishing page and used the ShortURL link-shortening service for the first-stage redirection. As part of the attack, the group employed a webhook relying on HTML to load a PDF lure document in the browser for two seconds. The victim was then redirected to a second webhook hosting the spoofed OWA login page. The HTML element was also designed to capture victim information using a JavaScript function and send it to the hidden form element’s webhook. The victim was then redirected to the legitimate PDF document. In July, the APT deployed a spoofed OWA login portal containing Turkish-language text and targeting Turkish scientists and researchers. A similar PDF lure and credential-harvesting mechanism was used. Spoofed Sophos VPN and Google pages In June, the hacking group deployed a spoofed Sophos VPN password reset page hosted on InfinityFree infrastructure. After entering their credentials, the victim was redirected to the legitimate portal belonging to an EU think tank. In September, the threat actor was seen hosting two spoofed OWA expired password pages on an InfinityFree domain, using JavaScript code similar to the one on the Sophos VPN phishing page. The pages redirected to the login pages of a military organization in North Macedonia and of an IT integrator in Uzbekistan, respectively. In April, Recorded Future discovered a spoofed Google password reset page in Portuguese, hosted on a free apex domain from Byet Internet Services. An HTML form on the page harvested credentials and sent them to a page hosted on ngrok-free[.]app. APT28 was abusing Ngrok’s “free service that enables users to connect servers behind a firewall to a proxy server and expose that server to the internet without changing firewall rules.” A second Google credential-harvesting page, also in Portuguese and using the Ngrok URL to capture credentials, was hosted on a domain associated with InfinityFree. “The group’s demonstrated ability to adapt its infrastructure and rebrand credential-harvesting pages suggests it will continue to abuse free hosting, tunneling, and link-shortening services to reduce operational costs and obscure attribution,” Recorded Future notes. Related: UK Sanctions Russian Hackers Tied to Assassination Attempts Related: Russian APT Hits Ukrainian Government With New Malware via Signal Related: Reporters Without Borders Targeted by Russian Hackers

Microsoft is investigating a known issue that causes the classic Outlook email client to crash upon launch, which can only be resolved via Exchange Online support. According to a recently published support document, this impacts Microsoft 365 customers who use classic Outlook on Windows systems. While the company didn't specify the root cause of this ongoing issue, it advised affected customers to open a support case from the Microsoft 365 Admin portal, which will prompt the Exchange Online support team to request a service change to mitigate it. "This error message can occur for different reasons. Not every instance of this error is the same issue but recent support cases around this have been for user mailboxes," the company said. "Currently, the only way to address this issue is to open a support case from the Microsoft 365 Admin portal. Exchange Online support will need to request a change from the service to mitigate." On affected systems, users are seeing an error message warning that Outlook cannot start, and an attempt to log into the Exchange account has failed. While the company is still investigating and working on a fix, it prompted those seeing this error to confirm if they're affected by capturing a Fiddler trace and searching for an "LID: 49586 - Authentication concurrency limit is reached." error. Microsoft also said that affected customers could use the new Outlook for Windows or Outlook Web Access (OWA) as a temporary workaround to access their mailboxes. Another support document addressing "Cannot start Microsoft Outlook. Cannot open the Outlook Window" errors prompts users to go through the following troubleshooting steps to resolve Outlook startup issues: Start Outlook in safe mode and disable add-ins Create a new Outlook profile Repair your Outlook data files Run the /resetnavpane command Since the start of the year, Redmond has also fixed a known issue causing CPU spikes when typing messages in classic Outlook and a bug that broke email and calendar drag-and-drop functionality in classic Outlook after installing Windows 24H2 updates. More recently, it addressed a bug that triggered classic Outlook crashes when opening emails or starting new messages and shared a temporary fix for a known issue that caused Outlook errors when opening encrypted emails sent from other organizations. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A threat actor claiming to have launched a new ransomware-as-a-service (RaaS) venture is leveraging AI chatbots in its negotiation panel to automate communication and apply psychological pressure on victims. In June 2025, a ransomware actor known by the alias $$$ publicly introduced a new RaaS brand, GLOBAL GROUP, on the Russian Anonymous Market Place (RAMP or Ramp4u) cybercrime forum. Researchers at Picus Security promptly conducted a forensic investigation across malware samples, infrastructure configuration and control logic, which included analyzing leaked API metadata, reverse-engineered binary code and threat actor behavior. They concluded that GLOBAL GROUP had very few new features but instead included capabilities found in the Mamona RIP and Black Lock ransomware families. In a July 21 report, Picus Security assessed that GLOBAL GROUP was a rebranding of these two groups. “At every layer, payload, delivery, control, and operation, GLOBAL reveals continuity and maturity more than innovation,” the researchers wrote. Negotiation Panel Equipped with an AI Chatbot However, one innovation the GLOBAL group has introduced is the use of an AI chatbot to kick off the negotiation process. The ransomware group offers a dual-portal model, directing victims to a Tor-based data leak site and a separate negotiation panel – a structure reminiscent of LockBit’s compartmentalized backend, suggesting that GLOBAL employs a double-extortion approach. Once on the negotiation panel, the victim is greeted by an AI-powered chatbot designed to automate communication and apply psychological pressure. The panel is designed for non-technical users, featuring prompts to upload a sample encrypted file for free decryption verification. All correspondence takes place over a secure channel, with a timer displayed to reinforce the urgency. Chat transcripts reviewed by analysts show demands reaching seven-figure sums, such as BTC9.5 ($1m at the time the negotiation process occurred), with escalating threats of data publication. GLOBAL’s affiliates have access to this panel in order to monitor negotiations, set ransom windows and even interact with victims directly via a mobile-friendly interface. “The integration of AI chat automation reduces the affiliate workload and ensures negotiations proceed even in the absence of human operators, enabling GLOBAL to scale victim engagement across time zones, languages, and organizational profiles,” the Picus Security researchers wrote. GLOBAL’s Techniques, Tactics and Procedures The majority of GLOBAL’s techniques, tactics, and procedures (TTPs) are borrow from Mamona RIP, Black Lock and Lockbit. The emerging ransomware group employs a cross-platform Golang-based payload, leveraging Go’s static linking and concurrency features to maximize encryption speed across Windows, Linux and macOS systems. This aligns with modern ransomware trends, where attackers favor Go for its efficiency in large-scale encryption. A key tactic is the reuse of a mutex string (Global\Fxo16jmdgujs437) previously seen in Mamona RIP, suggesting code inheritance rather than simple repackaging. This mutex ensures single-instance execution, preventing multiple ransomware processes from running simultaneously. Additionally, the group uses ChaCha20-Poly1305 encryption, a modern algorithm that provides both confidentiality and integrity, similar to Black Lock and LockBit, which also favor strong encryption schemes to deter recovery efforts. The ransom note is hardcoded into the binary and written to disk as README.txt, containing coercive language and a proof-of-decryption mechanism to build trust. This mirrors Mamona RIP’s approach, where psychological pressure is combined with technical validation. Notably, the group’s frontend API exposure reveals operational security failures, such as leaking backend SSH credentials and real IP addresses (e.g., 193.19.119[.]4), tying them to Russian VPS provider IpServer, the same infrastructure linked to Mamona. This suggests a shared development lineage or at least overlapping operational practices between the two groups. The GLOBAL ransomware builder is a RaaS platform with a customizable payload generator, allowing affiliates to configure encryption percentages, file extensions and additional malicious behaviors (e.g., process killing, log deletion, and self-deletion). This modular approach, where features are dynamically included at compile time, helps evade detection, a tactic also seen in LockBit’s builder. The ability to target ESXi, BSD and NAS appliances further expands its reach, similar to Black Lock’s focus on hybrid environments. The use of goroutines for concurrent encryption and filename encryption to hinder recovery efforts is an additional refinements that enhance its effectiveness, borrowing elements from both Mamona RIP and LockBit in terms of execution efficiency and evasion techniques. Detection, Mitigation and Response Strategies Against GLOBAL In their report, the Picus Security researchers shared a comprehensive list of strategies and measures security teams can implement to detect, mitigate and respond to the GLOBAL ransomware threat. These include: Detecting multithreaded ChaCha20-Poly1305 encryption by monitoring abnormal CPU/memory spikes and cryptographic API calls in Golang-based processes Identifying ransomware activity by tracking custom file extensions and encrypted filenames through file access monitoring and anomaly detection Monitoring for abuse of native utilities such as wevtutil, vssadmin, and net use, which attackers use for log tampering, shadow copy deletion and lateral movement Tracking unauthorized SSH access to cloud infrastructure, particularly from unusual geolocations or known malicious IPs linked to ransomware operations Detecting session hijacking and credential replay attacks by analyzing authentication anomalies in OWA (Outlook Web Access) and RDWeb (Remote Desktop Web Access) Conducting behavioral analysis to identify rare mutex strings (e.g. Global\Fxo16jmdgujs437), which may indicate single-instance ransomware execution Correlating lateral movement patterns originating from non-domain-joined endpoints, a common sign of initial access or privilege escalation Analyzing service-level telemetry for suspicious process chains (e.g., OpenProcess → TerminateProcess) and credential reuse across different protocols Simulating GLOBAL’s attack techniques using breach and attack simulation (BAS) to validate detection and response capabilities Assessing security controls to ensure they block real-world attack behaviors, not just static indicators of compromise (IOCs) Identifying and remediating blind spots caused by misconfigured detection rules or gaps in telemetry coverage Applying vendor-specific mitigations (e.g., Microsoft Defender, CrowdStrike, SentinelOne) to address validated security gaps Restricting the execution of Golang binaries in high-risk environments and monitoring for unusual Go-based processes Enforcing least-privilege access controls to limit ransomware’s ability to encrypt files or delete backups Disabling unnecessary native utilities (e.g., wevtutil, vssadmin) via Group Policy or application control policies Monitoring and blocking Tor-based command-and-control (C2) traffic and known ransomware leak site domains (e.g. .onion addresses) Implementing network segmentation to prevent lateral movement from compromised endpoints to critical assets