Russian hackers exploit Exchange OWA zero-day for long-term mailbox access
Exchange OWA zero-day exploited by state actors; enforce MFA and monitor intensely.
The headline is about another Exchange zero-day, but the useful question is what this story reveals about our security programs when there’s no patch to deploy.
What happened
A Russian state-sponsored group (tracked as Laundry Bear or Void Blizzard) is using a zero-day vulnerability in Microsoft Exchange Outlook Web Access (OWA). The exploit installs a backdoor called OWAReaper, giving them long-term access to mailboxes for espionage. Since it’s a zero-day, there is no official patch available from Microsoft yet.
What people will get wrong
The common mistake is to treat this as a news item and wait for a patch. The story isn’t just “state actors hacking Exchange again.” The real failure mode is assuming your existing controls are working as advertised. This is a test of ownership, visibility, and response discipline before a patch is even on the table.
If you think this is just an Exchange problem, you’re missing the point. This is a story about identity, logging, and detection.
The practitioner’s view
That sounds simple, but it’s where security programs break. The immediate reaction is to talk about MFA, but the real question is whether you can prove it’s actually enforced.
- Is your MFA universal? A policy saying “we use MFA for OWA” is not a control. Can you prove it’s enforced on every single access path, without exception? This is the kind of event that finds the one legacy endpoint where MFA was “temporarily” disabled.
- Are you watching the logs? The exploit itself might be invisible, but the backdoor’s activity shouldn’t be. Unusual access patterns, weird user agents, or connections from strange geolocations are the signals. But only if you’re actually collecting the right OWA logs and have a baseline for what “normal” looks like. If nobody owns the logs, nobody is going to see the attack.
- Who owns the response? When an alert for suspicious mailbox access fires, who gets the ticket? The security team? The Exchange admins? If that handoff isn’t defined and practiced, the alert will just sit there while the attackers dig in deeper. This is really an ownership problem.
Enforcing MFA isn’t about stopping the initial exploit; it’s about making it harder for an attacker to maintain persistence or move laterally with stolen session tokens. It forces them to make more noise, which gives your detection a better chance.
What to watch next
The next useful signal isn’t what the attackers do, but what your team does. Use this as a no-notice drill. Can you verify your OWA exposure and MFA coverage right now? Can you pull the logs to hunt for anomalous activity?
The story will fade from the news feeds, but the weaknesses it exposes in our programs won’t fix themselves. The question is whether this becomes a catalyst for verifying your controls or just another headline that scrolls by.
Source: Russian hackers exploit Exchange OWA zero-day for long-term mailbox access