Threat Actor
TA488
- First Reported
- Jul 15, 2026
- Latest Reported
- Aug 7, 2026
Reported Context (3)
- Reported to exploit CVE-2026-42897 to deploy OWAReaper. Recorded Future Identifies 85 High-Impact Vulnerabilities in July, Many Actively Exploited
- Proofpoint attributes the Outlook Web Access exploitation and OWAReaper campaign to TA488. TA488 Uses Outlook Web Access XSS to Deploy Persistent OWAReaper Implant
- Threat actor Proofpoint reports exploiting Zimbra with ZimReaper to steal email and credentials; the article says TA488 is also known as Void Blizzard and Laundry Bear. TA488 Used Zimbra XSS Flaw to Steal Emails and Maintain Access
CVE (81)
Malware (5)
People (1)
Threat Actors (9)
MITRE ATT&CK (13)
Vendors (25)
Products (75)
Tools (2)
Industries (10)
Countries (3)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.