Void Blizzard

Void Blizzard’s cyberespionage operations tend to be highly targeted at specific organizations of interest to the Russian government, including in government, defense, transportation, media, non-governmental organizations (NGOs), and healthcare sectors primarily in Europe and North America. The threat actor uses stolen credentials—which are likely procured from commodity infostealer ecosystems—and collects a high volume of email and files from compromised organizations.

Grubun kökeni Rusya olarak bildiriliyor.

Grup 2 zararlı yazılım ailesiyle ilişkilendirildi.

Diğer adları: LAUNDRY BEAR, UAC-0190, TA488, Laundry Bear

Grup 2 zararlı yazılım ailesiyle ilişkilendirildi.

Bu aktör hakkında yayımlanmış raporlar:

• https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/
• https://www.aivd.nl/actueel/nieuws/2025/05/27/onbekende-russische-groep-achter-hacks-nederlandse-doelen
• https://cert.gov.ua/article/6286942

Kaynak: MISP Galaxy, Malpedia.