Threat reportAPTTL-2026-0796
Void Blizzard (LAUNDRY BEAR) Russian State-Sponsored Cloud-Espionage Actor — Russian National Denis Nikolayevich Obrezko Charged (June 2026)
Void Blizzard (LAUNDRY BEAR) Russian State-Sponsored (TL-2026-0796), also tracked as LAUNDRY BEAR, is a high-severity advanced persistent threat campaign, first published 2026-06-14. It is attributed to Void Blizzard (Russia) with high confidence, affects Microsoft Microsoft Entra ID / Exchange Online / SharePoint Online /, maps to 20 MITRE ATT&CK techniques (T1069, T1078, T1087), and is covered by 9 detection rules and 19 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 20MITRE ATT&CK
- Actors
- 1Void Blizzard
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 19Indicators of compromise
Key facts for TL-2026-0796
- Threat ID
- TL-2026-0796
- Also known as
- LAUNDRY BEAR
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- Void Blizzard
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- government, law enforcement, defense, defense industrial base, transportation, aviation, communications, telecommunications, information technology, healthcare, education, media
- Target regions
- Europe, North America, Ukraine, Netherlands, NATO member states, European Union, Eastern Asia, Central Asia
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in Void Blizzard (LAUNDRY BEAR) Russian State-Sponsored
Malware and tooling: commodity infostealer, AzureHound, Evilginx
How Void Blizzard (LAUNDRY BEAR) Russian State-Sponsored works
Void Blizzard (also tracked as LAUNDRY BEAR) is a Russia-affiliated state-sponsored cyberespionage actor, active since at least April 2024, that conducts high-volume cloud-abuse operations against governments, defense, NATO member states, and Ukraine. The actor relies on stolen credentials/session cookies, password spraying, and Evilginx adversary-in-the-middle phishing via typosquatted Microsoft Entra domains to harvest cloud email, files, and Microsoft Teams data. On June 11, 2026, Russian national Denis Nikolayevich Obrezko was charged by the U.S. DOJ with conspiracy to commit unauthorized computer access for providing VPS and domain-registration infrastructure to the campaign.
Void Blizzard (Microsoft) / LAUNDRY BEAR (Dutch AIVD/MIVD) is a Russia-affiliated threat actor assessed with high confidence to conduct cyberespionage in support of Russian strategic intelligence objectives. Microsoft Threat Intelligence first publicly detailed the group on May 27, 2025 in a coordinated disclosure with the Netherlands General Intelligence and Security Service (AIVD), the Netherlands Defence Intelligence and Security Service (MIVD), and the U.S. FBI. The actor has been active since at least April 2024 and disproportionately targets NATO member states, the European Union, and Ukraine, as well as Eastern and Central Asia.
The group is characterized by methodical but technically unsophisticated tradecraft applied at scale. Initial access is most often achieved using stolen sign-in credentials and web session cookies purchased from commodity infostealer marketplaces, which are then leveraged in password-spray and pass-the-cookie (web session cookie replay) attacks against Microsoft Exchange Online, SharePoint Online, and Entra ID. Beginning in April 2025, the actor escalated to targeted adversary-in-the-middle (AitM) spear phishing using the open-source Evilginx framework. In one April 2025 campaign, Void Blizzard sent more than 20 European and U.S. non-governmental organizations spoofed invitations to a fictitious 'European Defense and Security Summit,' delivering PDF attachments containing malicious QR codes that redirected victims to a typosquatted domain (micsrosoftonline[.]com) impersonating the Microsoft Entra authentication portal to capture credentials and MFA tokens.
Following authentication, the actor abuses legitimate cloud APIs — Exchange Online and Microsoft Graph — to enumerate user mailboxes, shared mailboxes, and delegated resources, then performs bulk automated collection of emails and cloud-hosted files. The actor also accesses Microsoft Teams conversations through the web client and catalogs the victim's Microsoft Entra ID configuration (users, roles, and tenant structure) for organizational mapping, in some cases using the publicly available AzureHound tool for Entra enumeration. The group generally avoids deploying custom malware, instead living off legitimate cloud services and commercial proxy/VPN infrastructure to blend in; operators select U.S.-based commercial proxy IPs matching the victim's region to evade geographic conditional-access controls.
Confirmed and reported victims include the Netherlands national police (September 2024, theft of officers' work contact details), a Ukrainian aviation organization previously targeted by GRU actor Seashell Blizzard (October 2024), 20+ NGOs in the April 2025 phishing campaign, and at least 11 U.S. companies cited in the June 2026 DOJ charging documents. On June 11, 2026, Denis Nikolayevich Obrezko appeared in U.S. court and agreed to be taken into custody pending trial on a charge of conspiracy to commit unauthorized computer access; investigators allege he purchased the virtual private servers and registered the domain names used to support Void Blizzard operations. No CVE is associated with this actor — intrusions rely on credential abuse and social engineering rather than software vulnerabilities.
MITRE ATT&CK techniques used in TL-2026-0796
Discovery
T1069 Permission Groups Discovery; T1087 Account Discovery; T1538 Cloud Service Dashboard
Initial Access
T1078 Valid Accounts; T1566 Phishing
Defense Evasion
Command and Control
Persistence
Credential Access
T1110 Brute Force; T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores; T1557 Adversary-in-the-Middle
Collection
T1114 Email Collection; T1213 Data from Information Repositories; T1530 Data from Cloud Storage
Exfiltration
T1537 Transfer Data to Cloud Account; T1567 Exfiltration Over Web Service
lateral-movement
T1550 Use Alternate Authentication Material
Resource Development
T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1588 Obtain Capabilities
Affected products and versions in Void Blizzard (LAUNDRY BEAR) Russian State-Sponsored
- Microsoft — Microsoft Entra ID / Exchange Online / SharePoint Online / Microsoft Teams (Microsoft 365 cloud tenants)
Vulnerable versions: Microsoft 365 / Entra ID cloud tenants without phishing-resistant MFA
Remediation for Void Blizzard (LAUNDRY BEAR) Russian State-Sponsored
Immediate actions
- Block known Void Blizzard typosquatted domains (micsrosoftonline[.]com, miscrsooft[.]com, ebsumrnit[.]eu) and the outlook-office.micsrosoftonline[.]com host at email gateways, web proxies, and DNS resolvers
- Hunt for and revoke active sessions/refresh tokens for accounts showing password-spray or impossible-travel sign-ins; force credential reset for any account suspected of infostealer compromise
- Audit Microsoft Graph and Exchange Online API activity for anomalous bulk mailbox/file enumeration and non-owner mailbox access
- Block the malicious attachment SHA-256 06a5bd9cb3038e3eec1c68cb34fc3f64933dba2983e39a0b1125af8af32c8ddb at mail flow and endpoint
Workarounds
- Restrict or alert on AzureHound / Entra enumeration tooling within the tenant
- Apply least-privilege to privileged and service accounts; review delegated mailbox and application permissions
- Geo-fence and block known commercial proxy/VPN IP ranges where business requirements permit
Longer-term hardening
- Deploy phishing-resistant MFA (FIDO2 security keys, Authenticator passkeys) and deprecate SMS/voice OTP
- Enforce Conditional Access sign-in risk policies and restrict legacy authentication protocols
- Enable mailbox auditing for all mailboxes and monitor non-owner mailbox access via Exchange admin reports
- Deploy Microsoft Defender for Cloud Apps anomaly-detection policies for cloud data exfiltration and token theft
Timeline of Void Blizzard (LAUNDRY BEAR) Russian State-Sponsored
- Earliest observed Void Blizzard / LAUNDRY BEAR activity per Microsoft Threat Intelligence (active since at least April 2024).
- U.S. investigators began receiving tips (June-July 2024) from foreign partners and private-sector firms about the campaign's victims.
- Void Blizzard infiltrated the Netherlands national police, stealing officers' work-related contact details (disclosed by Dutch intelligence).
- Compromise of a Ukrainian aviation organization previously targeted by GRU actor Seashell Blizzard in 2022.
- Void Blizzard expanded collection by abusing compromised Exchange Online and Microsoft Teams access to bulk-exfiltrate cloud email, files, and chat messages from victim tenants via legitimate APIs.
- Microsoft identified an Evilginx AitM spear-phishing campaign using fake 'European Defense and Security Summit' lures with malicious QR-code PDFs, targeting 20+ NGOs in Europe and the U.S.
- Dutch AIVD/MIVD published their joint advisory designating the actor LAUNDRY BEAR, correlating it with Microsoft tracking the same cluster as Void Blizzard and confirming Russian state sponsorship.
- Microsoft, Netherlands AIVD/MIVD, and the FBI publicly disclosed and attributed Void Blizzard / LAUNDRY BEAR to Russia with high confidence.
- The U.S. Department of Justice unsealed the conspiracy-to-commit-unauthorized-computer-access charge against Denis Nikolayevich Obrezko, marking the first public criminal attribution of a Void Blizzard operator.
- Russian national Denis Nikolayevich Obrezko appeared in U.S. court and was charged with conspiracy to commit unauthorized computer access for purchasing VPS and registering domains used in the campaign; agreed to custody pending trial. DOJ cited verified intrusions at 11 U.S. companies.
Sources cited for Void Blizzard (LAUNDRY BEAR) Russian State-Sponsored
- New Russia-affiliated actor Void Blizzard targets critical sectors for espionage
- Russian national charged in Void Blizzard cyber-espionage campaign
- New Russian state-sponsored APT quickly gains global reach, hitting expansive targets
- Dark Web Profile: Void Blizzard
- Microsoft, Dutch security agencies lift veil on Laundry Bear cyber espionage group
- Microsoft details Void Blizzard as Russian cyber threat targeting global critical infrastructure
- Microsoft Threat Intelligence (MsftSecIntel) disclosure thread on Void Blizzard / LAUNDRY BEAR
Detection coverage for TL-2026-0796
As of 2026-06-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0796 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.