Executive Summary
Microsoft publicly named Void Blizzard on May 27, 2025, assessing with high confidence that it is a Russia-affiliated actor active since at least April 2024. Dutch intelligence agencies AIVD and MIVD had been independently tracking the same activity under the name LAUNDRY BEAR — a mapping later corroborated by a Dutch government letter to the Eerste Kamer (the Dutch senate) that surfaced the actor through its own investigation of an intrusion into a Dutch police network. The group’s tradecraft is notable mainly for how unremarkable it is: Microsoft describes its initial access methods, largely password spraying and the use of stolen credentials, as “largely unsophisticated.” What it lacks in exploit sophistication it makes up for in persistence and scale — a 2026 FBI criminal complaint describes at least 11 confirmed US company intrusions, almost certainly an undercount, built on stolen session tokens routed through geographically matched commercial proxy services to evade re-authentication challenges.
Naming and Identity
Microsoft is explicit that Void Blizzard is a distinct actor from the other Russia-nexus groups it tracks under the “Blizzard” naming convention — Forest Blizzard (APT28/GRU), Midnight Blizzard (APT29/SVR), Secret Blizzard (Turla/FSB), and Seashell Blizzard (Sandworm/GRU). The overlap between these groups is in targeting, not identity: several of them have gone after the same organizations or sectors at different times, which is a weaker form of connection than shared infrastructure or tooling. There is no dedicated MITRE ATT&CK group page for Void Blizzard or LAUNDRY BEAR at the time of this writing — a gap worth noting for anyone trying to map this actor’s techniques against a standard framework rather than vendor reporting alone. A 2026 SOCRadar report on related Zimbra exploitation activity also mentions the designations CL-STA-1114 and TA488 as possibly connected to the same campaign, but explicitly cautions that these labels may not map one-to-one onto Void Blizzard/LAUNDRY BEAR — an open question, not a confirmed alias set.
How It Gets In
The group’s bread-and-butter access methods are password spraying and the use of stolen credentials and session cookies, which Microsoft assesses likely originate from commodity infostealer marketplaces rather than from any custom credential-harvesting tool the group built itself. Alongside that, the group runs adversary-in-the-middle phishing using the open-source Evilginx framework, spoofing Microsoft Entra sign-in pages through typosquatted domains — one documented example substitutes characters to produce micsrosoftonline[.]com, with a subdomain structured as outlook-office.micsrosoftonline[.]com to look plausible to a hurried user. Since April 2025, Microsoft has observed a shift toward more targeted spear-phishing, using malicious PDF attachments and QR-code lures rather than relying solely on broad credential spraying.
Once inside a tenant, the group’s post-compromise behavior centers on abusing Exchange Online and Microsoft Graph APIs to conduct bulk collection of mail and files — including access to shared mailboxes, which widens the blast radius beyond a single compromised account — along with occasional use of the Teams web client and AzureHound for mapping out Entra ID tenant structure. A 2026 FBI affidavit adds a specific operational detail: the group leans heavily on stolen session tokens specifically to bypass re-authentication prompts, and routes its connections through US-based commercial proxy and VPN services chosen to geographically match the victim’s expected location — a deliberate move to blend in with normal access patterns rather than trigger impossible-travel or geo-anomaly alerts.
The Zimbra Question
A more recent and less settled piece of the picture involves CVE-2025-66376, a stored cross-site scripting vulnerability in the Classic UI of Zimbra Collaboration Suite that abuses CSS @import behavior. Synacor patched it in November 2025, and CISA added it to the Known Exploited Vulnerabilities catalog in mid-March 2026, with a remediation deadline of April 1, 2026. A joint government advisory links exploitation of this flaw “primarily” to LAUNDRY BEAR — but given the CL-STA-1114/TA488 naming ambiguity noted above, this attribution should be read as the current best assessment rather than an airtight one. Whether this represents a genuinely new access vector for the group or simply a newly documented one is also not fully clear from available reporting.
Law Enforcement Response
The clearest concrete 2026 development is a criminal case against a named individual. Denis Nikolayevich Obrezko, a Russian national, was arrested in Phuket, Thailand, on November 6, 2025, in a joint operation between Thai police and the FBI, and was subsequently extradited to the United States. A federal criminal complaint — conspiracy to commit unauthorized computer access — was unsealed in June 2026, accusing Obrezko of providing the VPS infrastructure and domains that supported Void Blizzard’s operations. This case targets infrastructure support rather than describing Obrezko as an operator conducting the intrusions himself, a distinction worth preserving when summarizing the charge.
Who’s Being Targeted
Microsoft’s published targeting list spans communications and telecommunications, the defense industrial base, healthcare, education, government and law enforcement, IT, intergovernmental organizations, media, NGOs, and transportation — concentrated heavily in NATO member states and Ukraine. Specific documented incidents include a Ukrainian aviation organization in October 2024; an adversary-in-the-middle campaign in April 2025 against more than 20 NGOs across Europe and the United States, using a fake invitation to a “European Defense and Security Summit” as the lure; and the Dutch National Police breach from September 2024 that exposed staff contact information and first brought the LAUNDRY BEAR designation to public attention via the Dutch government’s own disclosure. The 2026 FBI case independently confirms at least 11 US companies as verified intrusions — described in the complaint as likely an undercount of the actor’s actual US footprint.
Status, Late 2026
Based on the ongoing US legal case against Obrezko, Void Blizzard is assessed as still active, but no specific named campaign dated between August and October 2026 was identified for this piece — the most concrete recent developments (the Zimbra CVE KEV addition, the Obrezko complaint) cluster in the January-through-July 2026 window. That’s a gap worth flagging rather than papering over; it may reflect reduced recent visibility rather than an actual slowdown. No official MITRE ATT&CK mapping exists for this group; a third-party advisory (HivePro, tracking designation TA2025166) proposes a set of techniques — including valid accounts, spearphishing links and attachments, token theft and re-use, external proxy usage, and application-layer C2 — but these are vendor inferences rather than a primary-sourced framework mapping, and should be presented with that caveat.
What This Means
Void Blizzard is a useful corrective to the assumption that sophisticated access requires sophisticated exploits. Password spraying, stolen session tokens, and AitM phishing against a mistyped-domain Entra login page got this group into government, defense, and critical-infrastructure organizations across NATO and Ukraine, and at least 11 confirmed US companies. For defenders, conditional access policies that specifically account for token theft and replay — not just password strength — and close monitoring of Graph API usage patterns for bulk mailbox access are more relevant controls here than vulnerability patching alone, though the CVE-2025-66376 Zimbra flaw, now in CISA’s KEV catalog, should still be remediated given its tentative link to this actor’s operations.