Back Feeds.4Sysops

Russian hackers use OWAReaper to keep Microsoft OWA access after resets

Feeds.4Sysops •IT News • July 30, 2026

A Microsoft Outlook Web Access flaw is allowing the Russian-aligned TA488 group to establish mailbox access that survives password changes, browser restarts, and full device reimaging. Its OWAReaper implant turns a single email open into persistent, server-side Exchange permissions. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Russian Hackers Exploit OWA Flaw for Persistent Mailbox Access The Russian-aligned TA488 group is exploiting a flaw in Microsoft Outlook Web Access (OWA) that allows them to maintain access to mailboxes even after password resets and device reimaging. This vulnerability enables the attackers to use an implant called OWAReaper, which grants them persistent server-side permissions by simply opening an email. The attack affects Microsoft Exchange servers and poses a significant risk to organizations that rely on OWA for email access. The exploitation method allows the attackers to bypass traditional security measures, making it challenging for organizations to secure their email environments. As of now, there are no specific patches or mitigations disclosed to address this vulnerability. Organizations are urged to monitor their OWA environments closely for unusual activity. The situation is critical as it involves state-sponsored actors and impacts enterprise-level security. 2 sources 72

Extracted Entities

Russian hackers use OWAReaper to keep Microsoft OWA access after resets

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Malware (1)

Platforms (2)