# Void Blizzard (LAUNDRY BEAR) Russian State-Sponsored Cloud-Espionage Actor — Russian National Denis Nikolayevich Obrezko Charged (June 2026)

> Void Blizzard (also tracked as LAUNDRY BEAR) is a Russia-affiliated state-sponsored cyberespionage actor, active since at least April 2024, that conducts high-volume cloud-abuse operations against governments, defense, NATO member states, and Ukraine. The actor relies on stolen credentials/session cookies, password spraying, and Evilginx adversary-in-the-middle phishing via typosquatted Microsoft Entra domains to harvest cloud email, files, and Microsoft Teams data. On June 11, 2026, Russian national Denis Nikolayevich Obrezko was charged by the U.S. DOJ with conspiracy to commit unauthorized computer access for providing VPS and domain-registration infrastructure to the campaign.

- **Published:** 2026-06-14T00:00:00Z
- **Last reviewed:** 2026-06-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0796
- **ID:** TL-2026-0796
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Void Blizzard (Russia)
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Void Blizzard (Microsoft) / LAUNDRY BEAR (Dutch AIVD/MIVD) is a Russia-affiliated threat actor assessed with high confidence to conduct cyberespionage in support of Russian strategic intelligence objectives. Microsoft Threat Intelligence first publicly detailed the group on May 27, 2025 in a coordinated disclosure with the Netherlands General Intelligence and Security Service (AIVD), the Netherlands Defence Intelligence and Security Service (MIVD), and the U.S. FBI. The actor has been active since at least April 2024 and disproportionately targets NATO member states, the European Union, and Ukraine, as well as Eastern and Central Asia.

The group is characterized by methodical but technically unsophisticated tradecraft applied at scale. Initial access is most often achieved using stolen sign-in credentials and web session cookies purchased from commodity infostealer marketplaces, which are then leveraged in password-spray and pass-the-cookie (web session cookie replay) attacks against Microsoft Exchange Online, SharePoint Online, and Entra ID. Beginning in April 2025, the actor escalated to targeted adversary-in-the-middle (AitM) spear phishing using the open-source Evilginx framework. In one April 2025 campaign, Void Blizzard sent more than 20 European and U.S. non-governmental organizations spoofed invitations to a fictitious 'European Defense and Security Summit,' delivering PDF attachments containing malicious QR codes that redirected victims to a typosquatted domain (micsrosoftonline[.]com) impersonating the Microsoft Entra authentication portal to capture credentials and MFA tokens.

Following authentication, the actor abuses legitimate cloud APIs — Exchange Online and Microsoft Graph — to enumerate user mailboxes, shared mailboxes, and delegated resources, then performs bulk automated collection of emails and cloud-hosted files. The actor also accesses Microsoft Teams conversations through the web client and catalogs the victim's Microsoft Entra ID configuration (users, roles, and tenant structure) for organizational mapping, in some cases using the publicly available AzureHound tool for Entra enumeration. The group generally avoids deploying custom malware, instead living off legitimate cloud services and commercial proxy/VPN infrastructure to blend in; operators select U.S.-based commercial proxy IPs matching the victim's region to evade geographic conditional-access controls.

Confirmed and reported victims include the Netherlands national police (September 2024, theft of officers' work contact details), a Ukrainian aviation organization previously targeted by GRU actor Seashell Blizzard (October 2024), 20+ NGOs in the April 2025 phishing campaign, and at least 11 U.S. companies cited in the June 2026 DOJ charging documents. On June 11, 2026, Denis Nikolayevich Obrezko appeared in U.S. court and agreed to be taken into custody pending trial on a charge of conspiracy to commit unauthorized computer access; investigators allege he purchased the virtual private servers and registered the domain names used to support Void Blizzard operations. No CVE is associated with this actor — intrusions rely on credential abuse and social engineering rather than software vulnerabilities.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1586 Compromise Accounts
- T1588 Obtain Capabilities
- T1078 Valid Accounts
- T1566 Phishing
- T1110 Brute Force
- T1539 Steal Web Session Cookie
- T1557 Adversary-in-the-Middle
- T1555 Credentials from Password Stores
- T1098 Account Manipulation
- T1078 Valid Accounts
- T1550 Use Alternate Authentication Material
- T1087 Account Discovery
- T1069 Permission Groups Discovery
- T1538 Cloud Service Dashboard
- T1114 Email Collection
- T1530 Data from Cloud Storage
- T1213 Data from Information Repositories
- T1090 Proxy
- T1567 Exfiltration Over Web Service
- T1537 Transfer Data to Cloud Account

## Sources

- [New Russia-affiliated actor Void Blizzard targets critical sectors for espionage](https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/)
- [Russian national charged in Void Blizzard cyber-espionage campaign](https://cyberscoop.com/russian-national-charged-void-blizzard-cyber-espionage/)
- [New Russian state-sponsored APT quickly gains global reach, hitting expansive targets](https://cyberscoop.com/laundry-bear-void-blizzard-russia-apt/)
- [Dark Web Profile: Void Blizzard](https://socradar.io/blog/dark-web-profile-void-blizzard/)
- [Microsoft, Dutch security agencies lift veil on Laundry Bear cyber espionage group](https://www.helpnetsecurity.com/2025/05/27/microsoft-dutch-security-agencies-lift-veil-on-laundry-bear-void-blizzard-cyber-espionage-group/)
- [Microsoft details Void Blizzard as Russian cyber threat targeting global critical infrastructure](https://industrialcyber.co/ransomware/microsoft-details-void-blizzard-as-russian-cyber-threat-targeting-global-critical-infrastructure/)
- [Microsoft Threat Intelligence (MsftSecIntel) disclosure thread on Void Blizzard / LAUNDRY BEAR](https://x.com/MsftSecIntel/status/1927303600436310420)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0796