Russian state-backed hackers are actively exploiting a maximum-severity zero-day vulnerability in Microsoft Outlook’s Exchange Server. Tracked as TA488, the Kremlin-aligned group is deploying advanced “half-click” exploits to install a novel JavaScript backdoor named OWAReaper directly onto unpatched enterprise machines.
The Anatomy of a Half-Click Compromise
Security researchers from Proofpoint revealed that the campaign leverages sophisticated tactics requiring minimal interaction from targeted users. Instead of traditional phishing payloads that demand a malicious download or credential submission, simply opening an email routed through Outlook Web Access (OWA) triggers the vulnerability.
The infection chain terminates with OWAReaper, a custom-built JavaScript implant designed specifically for persistent, stealthy access inside OWA environments.
TA488—also known in threat intelligence circles as Laundry Bear and Void Blizzard—is rapidly scaling its capabilities. Just last week, Proofpoint and the National Security Agency (NSA) issued a joint advisory detailing similar attacks deployed against an email service from Zimbra using related zero-day methods.
Escalating Tradecraft and Enterprise Risk
The pivot to Microsoft Exchange infrastructure marks a significant escalation in the group’s operational tradecraft.
“TA488 is doubling down on the use of half-click exploits—where opening the email is enough to trigger compromise—with significantly improved loading mechanisms, techniques, and malware, signaling an improvement in the group’s tradecraft and capability,” Proofpoint researchers noted in their threat advisory.
Compromised OWA accounts allow the attackers to harvest credentials, siphon confidential data, and maintain long-term internal reconnaissance without tripping legacy perimeter defenses.
