Void Blizzard
Named by Microsoft (May 27, 2025), high confidence Russia-affiliated. Dutch intelligence (AIVD/MIVD) independently tracks the same actor as LAUNDRY BEAR, corroborated by a Dutch government letter to the Eerste Kamer. Distinct from Forest Blizzard, Midnight Blizzard, Secret Blizzard, and Seashell Blizzard — overlapping targeting only, not shared identity. · Espionage — bulk email/file collection
Tactics, Techniques & Procedures (TTPs)
- Password spraying and stolen credentials/session cookies, likely sourced from commodity infostealer markets — Microsoft calls this 'largely unsophisticated'
- AitM phishing via Evilginx, spoofing Entra sign-in pages via typosquat domains (e.g. micsrosoftonline[.]com)
- Since April 2025: targeted spear-phishing via malicious PDF/QR-code lures
- Abuses Exchange Online/Microsoft Graph APIs for bulk mail/file collection, including shared mailboxes; AzureHound for Entra ID mapping
- Heavy reliance on stolen session tokens to bypass re-authentication, routed through geo-matched commercial proxy/VPN services
Known Targets
Analyst Notes
No dedicated MITRE ATT&CK group page exists. Denis Nikolayevich Obrezko, a Russian national, was arrested in Phuket, Thailand (Nov 6, 2025) and extradited; a federal complaint unsealed June 2026 accuses him of providing VPS infrastructure supporting Void Blizzard operations. A tentative link to CVE-2025-66376 (Zimbra Classic UI stored XSS, CISA KEV since March 2026) is attributed 'primarily' to this actor but hedged given the naming-overlap caveat above. No named campaign dated Aug–Oct 2026 was identified.
Also Known As