Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
THREAT ADVISORY Russian APT “Laundry Bear” Exploiting OWA XSS for Persistent Mailbox Access August 5, 2026
Threat Actors
Excerpt
DOWNLOAD PDF Threat Actor: Laundry Bear (aka TA488, CL-STA-1114, UNK_PitStop, Void Blizzard) Vulnerability: CVE-2026-42897 (CVSS 8.1) – Cross-Site Scripting in Microsoft Outlook Web Access (OWA) Malware: OWAReaper (JavaScript browser-based implant) Activity Start: July 22, 2026 (infrastructure prepared as early as March 2026) Targets: U.S. & European government entities, telecommunications, financial services, hospitality, and aerospace sectors Summary Russian threat…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2025-66376 | High | Score 66/100 | First seen |
| CVE | CVE-2026-42897 | High | Score 69/100 | First seen |
IOC Relationship Graph
Building graph…