The threat group behind last month's Zimbra exploitation campaign has retooled and moved on to bigger prey. Since 22 July 2026, the same Russian actors have been exploiting a vulnerability in Microsoft Outlook Web Access (OWA) to plant browser-based implants on systems belonging to US and European government agencies, telcos, financial institutions, hospitality companies, and aerospace firms.

The attack is being described as a "half-click" technique — meaning the victim doesn't need to click a link or open an attachment in the traditional sense. Opening a booby-trapped email message is enough. From there, the implant lands in the browser and, here's the part that should concern every defender: it survives credential rotation and full disk re-imaging. Change your password after the breach? Doesn't matter. Wipe and rebuild the machine? Still there.

That's a significant escalation from what most incident response playbooks assume. The standard "contain, eradicate, recover" loop treats credential rotation and reimaging as the nuclear options — the things you do when all else fails. If an implant can ride out both, organisations need to think carefully about what "eradicated" actually means.

The pivot from Zimbra to OWA is itself a tell. Zimbra is common in government and financial sector deployments, particularly in Europe and the developing world. OWA means Microsoft Exchange — which is ubiquitous. This group has effectively traded a niche weapon for a mass-market one.

CISA and the relevant sector CERTs haven't yet published specific mitigations, so defenders are largely working from the raw reporting. The Register and The Hacker News both have solid technical details sourced from Ars Technica's coverage. The short version: if you're running OWA and haven't patched recently, that's your first call on Monday morning. If you have patched, the attack surface may still exist depending on your Exchange version and configuration.

The Australian angle is straightforward. Microsoft Exchange and OWA are deeply embedded across Australian government, state agencies, and enterprise. The Australian Signals Directorate's "Essential Eight" framework lists application patching as a top-tier control precisely for scenarios like this. The ASD's advisories on Russian cyber activity have been consistent over the past 18 months — this group is opportunistic and moves fast once a new vector proves viable.

What to watch: Whether Microsoft releases an out-of-band patch or formal advisory in the next 48 hours. Also watch for CISA adding the OWA CVE to its Known Exploited Vulnerabilities catalogue — once that happens, federal agencies (and any AU government bodies that mirror CISA guidance) have a hard clock ticking. The persistence mechanism in particular warrants a dedicated technical advisory; right now the public record doesn't fully explain how the implant survives reimaging, and that gap is going to drive a lot of speculation until it's filled.