Void Blizzard, a Russian state-sponsored APT attributed to the GRU and tracked as Laundry Bear by Dutch intelligence, has rapidly emerged as a major cyber espionage threat since April 2024. The group…

Void Blizzard, a Russian state-sponsored APT attributed to the GRU and tracked as Laundry Bear by Dutch intelligence, has rapidly emerged as a major cyber espionage threat since April 2024. The group…

Eine Sicherheitslücke in OWA ermöglicht durch Anzeigen von Mails das Ausführen von JavaScript-Code. Russische Akteure nutzen das aus.

The Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is exploiting an Exchange Outlook Web Access vulnerability in email campaigns to deliver a sophisticated backdoor called OWAReaper.

Laundry Bear, also tracked as Void Blizzard and TA488, is using the CVE-2026-42897 Outlook Web Access XSS flaw in half-click email attacks to deliver the OWAReaper backdoor. The campaign targets government and industry organizations across the U.S. and Europe and uses advanced persistence, credential theft, and multi-channel command-and-control to maintain long-term mailbox access. #LaundryBear #VoidBlizzard #TA488 #CVE-2026-42897 #OWAReaper #MicrosoftExchange #OutlookWebAccess

Russische Angreifer attackieren seit Juli 2025 westliche Regierungen und Einrichtungen durch eine Zero-Click-Lücke in Zimbra.

CISA says the Russian state-sponsored group Laundry Bear, also known as Void Blizzard, is targeting Zimbra Collaboration servers with phishing and the now-patched CVE-2025-66376 XSS flaw to steal email data and bypass MFA. The campaign has hit organizations across government, defense, education, energy, media, and NGOs, while exfiltrating stolen information through the group's Flowerbed framework and AiTM phishing kits. #LaundryBear #VoidBlizzard #Zimbra #CVE202566376 #Flowerbed

Federal prosecutors have charged Russian national Denis Nikolayevich Obrezko with conspiracy to commit unauthorized computer access in connection with a cyber-espionage campaign linked to Void Blizzard, also known as Laundry Bear. Investigators say the group targeted U.S. and European organizations, using stolen session tokens, proxy services, and typosquatted Microsoft domains to steal data and conceal its activity. #VoidBlizzard #LaundryBear #DenisNikolayevichObrezko #MicrosoftEntraID

Void Blizzard, a Russian state-sponsored APT attributed to the GRU and tracked as Laundry Bear by Dutch intelligence, has rapidly emerged as a major cyber espionage threat since April 2024. The group…

Void Blizzard, a Russian state-sponsored APT attributed to the GRU and tracked as Laundry Bear by Dutch intelligence, has rapidly emerged as a major cyber espionage threat since April 2024. The group…

A previously unknown Russian-backed cyberespionage group now tracked as Laundry Bear has been linked to a September 2024 Dutch police security breach. [...]

Hunting Laundry Bear: Infrastructure Analysis Guide and Findings