Russian hackers exploit Exchange OWA zero-day for long-term mailbox access
Russian state-sponsored hackers, Laundry Bear, are exploiting an Exchange Outlook Web Access vulnerability to deliver a sophisticated backdoor called OWAReaper. The hackers are targeting various organizations, including government entities and companies in the telecommuni…
Intelligence analysis by Llama
Laundry Bear is exploiting a zero-day vulnerability in Exchange OWA to deliver a backdoor called OWAReaper, which allows them to maintain access to a target's mailbox even if their system is restored from a clean image or credentials are rotated.
Imagine you're using a web-based email service, and you open an email that looks normal. But, secretly, it's trying to install a backdoor that lets hackers access your email account even if you change your password or reinstall your computer. This is what's happening with the OWAReaper backdoor, which is being used by Russian hackers to steal email addresses, usernames, and Outlook settings.
Analysis
A Sophisticated Backdoor Delivered via Half-Click Exploits
Laundry Bear, a Russian state-sponsored hacking group, has been exploiting an Exchange Outlook Web Access (OWA) vulnerability to deliver a sophisticated backdoor called OWAReaper. This backdoor is the most sophisticated delivered via half-click exploits, and it allows the hackers to maintain access to a target's mailbox even if their system is restored from a clean image or credentials are rotated.
Improper HTML Sanitization Triggers JavaScript Loader
The exploit delivers a backdoor that researchers call OWAReaper and describe as the most sophisticated backdoor delivered via half-click exploits they saw. Analysis revealed a suite of subtle persistence mechanisms and revealed it to be an evolution of the ZimReaper malware observed in the attacks against Zimbra email servers.
Long-Term Persistence Mechanism
The threat actor achieves this through OWAReaper, which checks for installed Outlook add-ins that have ReadWriteMailbox permissions and uses them to steal OAuth tokens through the GetClientAccessToken operation request. It then calls UpdateFolder to grant itself Owner-level permissions to the 'Default' user (a low-permission preset alias in all Microsoft Exchange tenants) on every mail folder. This allows attackers to access the mailbox from any authenticated account within the organization.
Two of Everything
The malware supports two command-and-control (C2) mechanisms for receiving instructions from the attacker. One of them uses GitHub commit messages as the communication channel. Every 24 hours, the malware queries GitHub's Commit Search API for encrypted messages that match a specific format and include the target's email address.
Key points
- Laundry Bear is exploiting an Exchange OWA zero-day vulnerability to deliver a sophisticated backdoor called OWAReaper.
- The backdoor allows hackers to maintain access to a target's mailbox even if their system is restored from a clean image or credentials are rotated.
- The malware supports two command-and-control (C2) mechanisms for receiving instructions from the attacker.
- The attackers are using GitHub commit messages as a C2 channel, which makes it difficult to track and disrupt their communication.
If this development plays out positively, it could lead to increased awareness and vigilance among email users, which might help prevent similar attacks in the future. Additionally, Microsoft's prompt response to the vulnerability could lead to a more secure Exchange OWA platform.
The realistic downside risks or failure modes of this development include the potential for widespread exploitation of the OWAReaper backdoor, which could lead to significant data breaches and compromise of sensitive information. Additionally, the use of GitHub commit messages as a C2 channel could make it difficult to track and disrupt the attackers' communication.
