Void BlizzardThreat actor
- Laundry Bear
- TA488
- UAC-0190
Void Blizzard’s cyberespionage operations tend to be highly targeted at specific organizations of interest to the Russian government, including in government, defense, transportation, media, non-governmental organizations (NGOs), and healthcare sectors primarily in Europe and North America.From MISP Galaxy
Last reported 3 days ago, by SecurityWeek6 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1684Social Engineering
“…rs and financially motivated attackers are employing a combination of supply chain attacks, account takeovers, cloud breaches, and social engineering techniques.”
- T1105Ingress Tool Transfer
“Script-based execution (such as PowerShell, VBScript, CMD, and JavaScript), obfuscation, ingress tool transfer, HTTP/HTTPS-based C2 communication, local system data collection, and data exfiltration via C2 paths were repeatedly observed.”
- T1219Remote Access Tools
“Attackers escalated privileges, established persistence via legitimate remote access tools, and in the most advanced case deployed DragonForce ransomware, resulting in environment-wide encryption.”
- T1221Template Injection
“Viceroy Tiger (Donot) targeted Bangladeshi military and defense officials using remote template injection and a multi-stage shellcode loader.”
- T1552.004Private Keys
“Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7“Noteworthy examples include ENERGETIC BEAR, Void Blizzard, and Sandworm which are all Russia linked.”
-
Cyber Brief 26-08 - July 2026“…ge & prepositioning front, the United States (US) Cybersecurity and Infrastructure Security Agency (CISA) reported that Russia-linked Laundry Bear had conducted zero-click phishing campaigns against organisations using Zimbra webmail, while journalists reported that Morocco’s int…”
-
July 2026 Threat Trend Report on APT Groups“TA458 and Void Blizzard exploited the “Half-click” vulnerability in Zimbra, Outlook Web Access, Roundcube, and SOGo to use ZimReaper and OWAReaper to collect credentials, contacts, and emails, and establish long-term persistence.”
-
Russian-Alligned TA488 Returns With Persistent Outlook Web Access Attack“Russian-Alligned TA488 Returns With Persistent Outlook Web Access Attack”
-
Russian Hackers Exploit New ‘Zero-Click’ Attack Against Western Organizations“The campaign has been attributed to cyber espionage operation which has been linked to Russia dubbed Laundry Bear, also known as Void Blizzard and UAC-0190.”
-
"Неблагонадійний фонд": цільові кібератаки UAC-0190 у відношенні СОУ з використанням PLUGGYAPE (CERT-UA#19092)“"Неблагонадійний фонд": цільові кібератаки UAC-0190 у відношенні СОУ з використанням PLUGGYAPE (CERT-UA#19092)”
Indicators in its reports
named in the reports above- cert[.]lvin 1 report
Copy this indicator · defanged
Thanks — we review every report.