Void Blizzard
Void Blizzard is a Russian state-sponsored cyber espionage threat actor aligned with Russian government objectives. It is also tracked as Laundry Bear and UAC-0190. Reporting in the provided content states the group has been active since at least April 2024 and has conducted large-scale espionage operations targeting organizations in NATO member states and Ukraine, as well as victims in Europe and North America. Reported target sectors include government agencies, defense suppliers and contractors, critical infrastructure providers, transportation, media, healthcare, educational institutions, NGOs, and security and defense organizations. Dutch authorities attributed the September 2024 compromise of the Dutch National Police to this actor. The group is described as focusing heavily on cyber espionage and mass email harvesting. Reported post-compromise objectives include stealing emails and files from cloud environments, accessing Microsoft Teams conversations, and cataloging Microsoft Entra ID configurations to map organizational structures and privilege relationships. Microsoft reported that Void Blizzard used AzureHound during discovery to enumerate Entra ID configurations. The content also states the group primarily uses stolen session tokens and purchased or stolen credentials for access, and uses a U.S.-based commercial proxy service plus VPN routing to mask origin and bypass geographic restrictions. Observed tradecraft in the provided content includes spear-phishing with typosquatted domains impersonating Microsoft authentication pages, adversary-in-the-middle phishing using Evilginx, and QR codes embedded in PDF attachments. One campaign targeted more than 20 NATO-affiliated organizations, and another targeted NGOs in Europe and the United States. CERT-UA reporting in the content says Void Blizzard also used sophisticated social-engineering approaches against Ukrainian armed forces and government institutions, including trust-building over phone or messaging platforms before sending malicious files. The content further links Void Blizzard/Laundry Bear/UAC-0190 with operations against Ukrainian entities. CERT-UA attributed with medium confidence a charity-themed espionage campaign targeting Ukraine’s Defense Forces between October and December 2025 to Laundry Bear, delivering the PluggyApe Python backdoor via Signal and WhatsApp social engineering and fake charity websites. Additional reporting cited in the content links the group with low confidence to the February 2026 DRILLAPP backdoor campaign targeting Ukrainian organizations. The content also notes use of the PLUGGYAPE malware family against Ukrainian defense forces. Aliases and tracking names directly mentioned in the content: Void Blizzard, Laundry Bear, and UAC-0190.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
- Military
- Transportation
- Media & Entertainment
- Health Care Equipment & Services
- Non-Governmental Organizations
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
- 🇺🇦 Ukraine
Where they're from
Attributed origin per open-source reporting.
- RU
Tradecraft
48 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
6 malware families attributed to this actor across reporting.
1 additional family tracked in Mallory.
Observables
142 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
State-sponsored cyberespionage operations targeting organizations in the United States and abroad, including businesses, educational institutions, and NGOs. The group steals session tokens to access victim accounts, harvests emails and files from compromised cloud environments, accesses Teams conversations, catalogs Microsoft Entra ID configurations, and conducts spear-phishing with typosquatted Microsoft authentication pages.
Russian state-sponsored espionage group conducting large-scale intrusions against government, defense, critical infrastructure, NGOs, businesses, and educational institutions; observed stealing session tokens, harvesting bulk email and files from cloud environments, accessing Microsoft Teams conversations, mapping Entra ID configurations, and running spear-phishing campaigns with typosquatted Microsoft login domains.
Russian hacking group linked to opportunistic espionage against Dutch police, stealing work-related contact data that could support profiling, coercion, tracking, recruitment, or influence operations.
A relatively new cyberespionage threat group operating in support of Russian government interests, targeting organizations across Europe and North America to steal emails and internal documents.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.