Threat Brief — 2026-07-30 — State-Sponsored Mailbox Backdoors & MaaS Expansion

Executive summary. Russian state-sponsored group Laundry Bear (Void Blizzard) is actively exploiting an Exchange Outlook Web Access zero-day to plant a persistent backdoor called OWAReaper in target mailboxes — a reminder that OWA remains a high-value perimeter attack surface. Southeast Asian cybercriminal syndicates have matured into a global services economy, with trafficking operations spanning 80+ countries and regional losses hitting $88B in 2025. The Flying Eagle Android RAT has evolved from a source-code leak into a full malware-as-a-service operation now adopted by multiple threat groups.

Top items

• Russian state actors exploit Exchange OWA zero-day for persistent mailbox access. Laundry Bear (aka Void Blizzard) is using an unpatched Exchange Outlook Web Access vulnerability to deliver OWAReaper, a backdoor designed for long-term mailbox persistence. Any organisation exposing OWA to the internet should treat this as an active, targeted threat and prioritise detection of anomalous OWA session behaviour. No CVE identifier was provided in the source. (src: BleepingComputer)

• Flying Eagle matures from source-code leak into full-service MaaS. What was first reported yesterday as a source-code leak with 170 C2 servers has now been characterised as a premium malware-as-a-service offering used by multiple threat groups to build banking-draining infostealers. The rapid operationalisation suggests the leaked code enabled faster threat-actor onboarding than initially assessed. (src: DarkReading)

• Southeast Asian cybercrime syndicates have scaled into a global services economy. These groups have shifted from goods-based fraud to a services model while continuing human-trafficking operations across 80+ countries, with estimated regional losses of $88 billion in 2025. The services orientation means their tooling, infrastructure, and laundered accounts are likely being rented to a broader criminal customer base. (src: DarkReading)

Themes

Attack-surface-as-a-service convergence: Both Flying Eagle (mobile MaaS) and the SE Asian syndicates (criminal-services platform) illustrate a continued industry shift where capabilities that once required bespoke development are now productised and rented. This lowers the barrier for less-sophisticated groups to conduct sophisticated operations, increasing volume and diversity of attacks defenders must triage.