Void Blizzard Exploits Exchange OWA Zero-Day to Deploy OWAReaper Backdoor

What Happened

According to BleepingComputer, the Russian state-sponsored threat group tracked as Laundry Bear (also known as Void Blizzard) is exploiting a zero-day vulnerability in Microsoft Exchange's Outlook Web Access (OWA) component. The campaign reportedly delivers a custom backdoor dubbed OWAReaper, which is described as providing sophisticated, long-term access to victim mailboxes. Details on the specific vulnerable Exchange version, exploitation prerequisites, and the vulnerability's technical root cause were not disclosed in the initial reporting.

Why It Matters

Exchange OWA is internet-facing in most on-premises and hybrid deployments, making it an attractive initial access vector for state-sponsored operators seeking mailbox access. A backdoor purpose-built for persistence on OWA suggests the actor is prioritizing durable, stealthy access to email — valuable for intelligence collection, credential harvesting, and downstream lateral movement — rather than smash-and-grab compromise. Organizations running self-hosted or hybrid Exchange with OWA exposed to the internet, particularly government, diplomatic, defense, and other high-value targets historically associated with Void Blizzard activity, should treat this as an elevated-priority concern.

What Defenders Should Watch For

• Review Exchange/IIS logs for anomalous OWA requests, unexpected process spawns from w3wp.exe, or unusual DLL/module loads tied to the OWA web application.
• Hunt for unexpected new files, web shells, or modified OWA/Exchange configuration files on Exchange servers, especially outside normal patch/maintenance windows.
• Look for anomalous mailbox access patterns — impersonation/application access, unusual export or search operations, or access from atypical IPs/geographies — via Exchange audit and Unified Audit logs.
• Monitor for outbound connections from Exchange servers to unfamiliar infrastructure, which could indicate backdoor command-and-control.
• Until an official patch is confirmed, consider restricting external OWA exposure where feasible and ensure Exchange servers are on supported, fully patched cumulative update levels.

This is developing intelligence based on a single vendor report, and technical indicators, a CVE identifier, and an official Microsoft advisory had not yet been published at the time of writing. We will track this story and issue detection content once further technical details or a patch are confirmed. Read the original report at BleepingComputer.