# APT28 Exploits Exchange OWA Zero-Day to Deploy OWAReaper Backdoor

> Russian APT28 hackers exploit an Exchange OWA zero-day to deploy the OWAReaper backdoor, gaining persistent access to high-value government mailboxes.

- Published: 2026-07-30T02:30:39.000Z
- Severity: high
- Category: Threat Intel
- Tags: APT28, CVE-2024-43451, OWAReaper, Microsoft Exchange
- Author: Runtime Rebel Intel
- Primary source: https://www.bleepingcomputer.com/news/security/russian-hackers-exploit-exchange-owa-zero-day-for-long-term-mailbox-access/
- Canonical: https://runtimerebel.com/blog/apt28-exploits-exchange-owa-zero-day-to-deploy-owareaper-backdoor

## Key points

- Russian state actors are gaining persistent access to government email systems by exploiting a critical vulnerability in Outlook Web Access.
- Microsoft Exchange Server instances with Outlook Web Access enabled are the primary targets for the OWAReaper backdoor deployment.
- Organizations must apply the latest Microsoft security updates and monitor for unauthorized modifications to Exchange IIS modules immediately.

The Russian [APT](/glossary#apt) group [APT28](https://en.wikipedia.org/wiki/APT28)—also known as Laundry Bear, Fancy Bear, or Void Blizzard—is actively exploiting a [Zero-Day](/glossary#zero-day) vulnerability in Microsoft Exchange Server's Outlook Web Access (OWA) to facilitate long-term mailbox access. According to [BleepingComputer](https://www.bleepingcomputer.com/news/security/russian-hackers-exploit-exchange-owa-zero-day-for-long-term-mailbox-access/), the threat actors are leveraging this access to deploy a specialized, high-persistence backdoor known as OWAReaper. This campaign is primarily focused on European government and military entities, underscoring the strategic priority the group places on [Supply Chain Attack](/glossary#supply-chain-attack) methods and sensitive communication channels.

The initial stage of the attack frequently involves the exploitation of [CVE-2024-43451](/cve/cve-2024-43451), an NTLM hash disclosure flaw. While the [CVSS](/glossary#cvss) score of 6.5 might seem moderate compared to an [RCE](/glossary#rce), its utility in credential theft is significant. By coercing a victim into a single interaction with a malicious file, [APT28](https://en.wikipedia.org/wiki/APT28) can capture hashes to perform NTLM relay attacks. This leads to [Privilege Escalation](/glossary#privilege-escalation) and allows the actor to bypass standard authentication without knowing the victim's password. This specific APT28 Exchange OWA exploitation highlights the group's ability to weaponize disclosure flaws into full-scale environmental compromise.

## Technical Analysis: OWAReaper and OWA Exploitation

OWAReaper is a sophisticated piece of malware designed to function as a malicious IIS module. By embedding itself directly into the Internet Information Services (IIS) framework that powers OWA, the backdoor can intercept web traffic, steal session tokens, and harvest credentials in real-time. Because it resides within the web server's native architecture, OWAReaper often evades [EDR](/glossary#edr) solutions that are tuned to detect suspicious child processes or unauthorized binary executions on the operating system level.

### Analyzing the OWAReaper Backdoor Capabilities

Once installed, OWAReaper serves as a persistent [C2](/glossary#c2) mechanism with several specialized functions. These functions allow [APT28](https://en.wikipedia.org/wiki/APT28) to maintain a stealthy presence while exfiltrating data. Key capabilities include:

- Real-time interception of OWA login credentials and session cookies.
- Execution of administrative commands directly through the IIS worker process.
- Targeted exfiltration of emails and attachments based on predefined intelligence requirements.
- Facilitation of [Lateral Movement](/glossary#lateral-movement) by providing valid credentials for other internal services.

Security teams researching **how to detect OWAReaper backdoor** should prioritize auditing the `bin` directories of their Exchange OWA installations. Specifically, analysts should look for any `App_Web_*.dll` files or other IIS modules that lack a valid digital signature from Microsoft. Monitoring modifications to the `web.config` file is also a vital [IoC](/glossary#ioc) for detecting module injection.

## Detecting APT28 Exchange OWA exploitation

Detecting this campaign requires more than just looking for known malware hashes. Since the initial exploitation of [CVE-2024-43451](https://nvd.nist.gov/vuln/detail/CVE-2024-43451) often relies on [Phishing](/glossary#phishing), a [SOC](/glossary#soc) must correlate external web requests with suspicious NTLM authentication attempts. Analysts should map these behaviors against the [MITRE ATT&CK](/glossary#mitre-att-ck) framework, specifically focusing on the use of Server Software Component: IIS Module (T1505.004).

Integration with a [SIEM](/glossary#siem) to monitor IIS logs for unusual POST requests or access to administrative interfaces from unknown IP addresses is recommended. Additionally, periodic integrity checks of the Exchange server's file system can help identify unauthorized persistence mechanisms.

## Mitigations and Defensive Recommendations

The most critical defense against this activity is the immediate application of the **Microsoft Exchange Server security patches November 2024**. These updates address the underlying vulnerabilities being weaponized in the wild. Beyond patching, defenders should implement the following controls:

1. **Restrict NTLM Usage:** Organizations should move toward Kerberos-only environments and use Protected Users Security Groups to prevent NTLM relay attacks.
2. **Enforce Zero Trust:** Implement [Zero Trust](/glossary#zero-trust) principles by requiring phishing-resistant MFA for all OWA and administrative access.
3. **IIS Module Auditing:** Regularly use command-line tools like `appcmd.exe` to list and verify all installed modules on the Exchange server.
4. **Log Retention:** Maintain at least 90 days of IIS and Exchange audit logs to facilitate retrospective threat hunting for [APT](/glossary#apt) activity.

**Related:** [UK and EU Sanction Russian APTs Over Critical Infrastructure Attacks](/blog/uk-and-eu-sanction-russian-apts-over-critical-infrastructure-attacks), [FamousSparrow Exploits Microsoft Exchange in Azerbaijani Energy Campaign](/blog/famoussparrow-exploits-microsoft-exchange-in-azerbaijani-energy-campaign)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/apt28-exploits-exchange-owa-zero-day-to-deploy-owareaper-backdoor