Overview of the OWA Persistence Campaign
Recent intelligence indicates that Russian state-sponsored actors, previously identified for their exploitation of vulnerabilities in Zimbra collaboration software, have shifted focus to target Microsoft Outlook Web Access (OWA). According to The Hacker News, this campaign began on July 22, 2026, and specifically targets U.S. and European government entities, alongside organizations in the telecommunications, financial, hospitality, and aerospace sectors.
The most alarming aspect of this activity is the ability of the APT group to maintain access to victim mailboxes even after standard remediation steps, such as credential rotation, have been performed. This indicates a sophisticated understanding of session management within Microsoft environments and a shift toward long-term persistence without the need for constant re-authentication via stolen passwords.
Technical Analysis: Bypassing Credential Rotations
The primary objective of this campaign appears to be persistent intelligence gathering. Traditionally, a Phishing attack or credential harvesting attempt would be neutralized once the IT SOC forces a password reset for the affected user. However, by exploiting a specific vulnerability within the OWA architecture, these actors are able to bypass the invalidation of active sessions.
While the source does not provide a specific CVE identifier for the OWA flaw, the TTP involves a mechanism where the attacker’s session remains valid or is automatically refreshed despite changes to the user’s primary authentication secret. This suggests the exploitation of token-based authentication or a flaw in how OWA handles session cookies. Once the initial access is gained, the attackers establish a persistent link to the mailbox, allowing for continuous data exfiltration and monitoring of sensitive communications.
How to Detect Microsoft OWA Persistence Exploit Activity
For security teams attempting to defend their infrastructure, understanding how to detect Microsoft OWA persistence exploit activity is paramount. Defenders should look for anomalous session activity originating from unexpected IP addresses or geographic locations. Specifically, monitoring for multiple active sessions for a single user account—where one session survives a password reset event—is a high-fidelity IoC. Additionally, security professionals should audit the use of delegated permissions or mailbox rules that may have been created by the actor to forward emails to an external C2 server.
Target Sectors and Attribution
The activity has been linked to APT28, a group often associated with the Russian General Staff Main Intelligence Directorate (GRU). This group has a long history of targeting high-value government and infrastructure sectors to facilitate espionage. The current campaign’s focus on the aerospace and telecommunications sectors suggests a strategic intent to gather technical specifications and intercept critical communications.
By targeting Microsoft OWA, the actors exploit a widely used interface that often sits at the edge of the corporate network. If successful, they can use this access for Lateral Movement within the internal environment, potentially leading to a broader compromise of the organizational directory services.
Microsoft OWA Vulnerability Mitigation Steps
To counter these Russian state-sponsored OWA attacks, organizations must go beyond simple password resets when a compromise is suspected. The following Microsoft OWA vulnerability mitigation steps are recommended to ensure complete remediation:
- Session Revocation: Forcefully terminate all active sessions for the compromised account. In Azure AD/Entra ID environments, this involves revoking all refresh tokens to ensure that the attacker’s existing session is immediately invalidated.
- Mandatory MFA: Implement hardware-based Multi-Factor Authentication (MFA) across all web-facing mail interfaces. This prevents attackers from easily re-establishing access even if they retain a foothold via other means.
- Audit Mailbox Rules: Regularly review mailbox forwarding rules and ‘move’ rules for all high-value accounts. Attackers frequently use these to maintain visibility into incoming mail even after their direct access is severed.
- Enhanced Logging: Ensure that OWA logs are being ingested into your SIEM and that they include detailed information about User-Agent strings and session IDs to help identify persistence patterns.