Void Blizzard
Void Blizzard is classified as state-sponsored.
- Malware families
- 2
- Origin
- Russia
- Also known as
- 4
Void Blizzard’s cyberespionage operations tend to be highly targeted at specific organizations of interest to the Russian government, including in government, defense, transportation, media, non-governmental organizations (NGOs), and healthcare sectors primarily in Europe and North America. The threat actor uses stolen credentials—which are likely procured from commodity infostealer ecosystems—and collects a high volume of email and files from compromised organizations.
The group's reported origin is Russia.
The group is associated with 2 malware families.
Also known as: LAUNDRY BEAR, UAC-0190, TA488, Laundry Bear
The group is associated with 2 malware families.
Malware families
- PLUGGYAPE
- ZimReaper
Published reports on this actor:
- https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/
- https://www.aivd.nl/actueel/nieuws/2025/05/27/onbekende-russische-groep-achter-hacks-nederlandse-doelen
- https://cert.gov.ua/article/6286942
Source: MISP Galaxy, Malpedia.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.