Void Blizzard
Named by Microsoft (May 27, 2025), high confidence Russia-affiliated. Dutch intelligence (AIVD/MIVD) independently tracks the same actor as LAUNDRY BEAR, corroborated by a Dutch government letter to the Eerste Kamer. Distinct from Forest Blizzard, Midnight Blizzard, Secret Blizzard, and Seashell Blizzard — overlapping targeting only, not shared identity. · Espionage — bulk email/file collection
Tactics, Techniques & Procedures (TTPs)
- Password spraying and stolen credentials/session cookies, likely sourced from commodity infostealer markets — Microsoft calls this 'largely unsophisticated'
- AitM phishing via Evilginx, spoofing Entra sign-in pages via typosquat domains (e.g. micsrosoftonline[.]com)
- Since April 2025: targeted spear-phishing via malicious PDF/QR-code lures
- Abuses Exchange Online/Microsoft Graph APIs for bulk mail/file collection, including shared mailboxes; AzureHound for Entra ID mapping
- Heavy reliance on stolen session tokens to bypass re-authentication, routed through geo-matched commercial proxy/VPN services
- Zero-click exploitation of CVE-2025-66376, a stored XSS vulnerability from insufficient sanitisation of CSS @import directives in Zimbra Collaboration Suite's email parsing pipeline
- Script executes in the victim's authenticated webmail session merely on preview/open — no click, attachment, or further victim action required
- Custom tooling dubbed 'Ulej' that extracts up to 90 days of historical email content, harvests Global Address List entries, and captures authentication tokens
- Campaign designed for quiet, sustained collection rather than noisy one-time exfiltration
Known Targets
Analyst Notes
No dedicated MITRE ATT&CK group page exists. Denis Nikolayevich Obrezko, a Russian national, was arrested in Phuket, Thailand (Nov 6, 2025) and extradited; a federal complaint unsealed June 2026 accuses him of providing VPS infrastructure supporting Void Blizzard operations. A tentative link to CVE-2025-66376 (Zimbra Classic UI stored XSS, CISA KEV since March 2026) is attributed 'primarily' to this actor but hedged given the naming-overlap caveat above. No named campaign dated Aug–Oct 2026 was identified. Additional reporting: Disclosed via a joint NCSC/Five Eyes-aligned advisory (AA26-204A) published 23 July 2026. The zero-click nature of the exploit defeats phishing-awareness training and email security gateways as primary defenses, since compromise does not depend on user behavior.
Also Known As
MITRE ATT&CK Techniques
Intelligence Reports
Void Blizzard Doesn't Need Zero-Days. Password Spraying and Stolen Tokens Got It Into 11+ US Companies
Microsoft named Void Blizzard in May 2025; Dutch intelligence had already been tracking the same actor as LAUNDRY BEAR. An FBI complaint unsealed in June 2026 accuses a Russian national of running the VPS infrastructure behind it — while the group itself keeps going.
LAUNDRY BEAR: Russia-Linked APT Exploits Zimbra for Zero-Click Email Collection
A joint NCSC and Five Eyes advisory has exposed LAUNDRY BEAR, a Russian state-supported threat actor exploiting a Zimbra Collaboration Suite XSS vulnerability to silently harvest 90 days of email from targeted accounts without any victim interaction.