Void Blizzard: High-Volume Russian Cloud Espionage

Void Blizzard is a Russia-affiliated cyber-espionage actor publicly detailed on 27 May 2025 in a joint effort by Microsoft Threat Intelligence and the Dutch intelligence services AIVD and MIVD. Microsoft tracks it as Void Blizzard; the Dutch services render it Laundry Bear. It is a comparatively low-sophistication but high-volume operator that gains access largely through stolen credentials and cookies bought from criminal and infostealer markets and through password spraying, then abuses cloud services — Exchange Online, Microsoft Graph and SharePoint — to bulk-collect email and files. From April 2025 it added adversary-in-the-middle spearphishing to harvest credentials and session cookies directly. Its collection disproportionately targets NATO states and Ukraine.

Overview & Attribution

Microsoft assesses Russia affiliation with high confidence, reading the activity as intelligence collection in support of Russian strategic objectives — concentrated on entities relevant to the war in Ukraine and on NATO members providing military and humanitarian aid. The Dutch services assess an espionage purpose, with non-destructive activity only to date. Void Blizzard is explicitly assessed as distinct from APT28 (Forest Blizzard): the Dutch advisory notes modus-operandi overlap but states they are two different actors. The specific sponsoring Russian service is not attributed in open sources.

Initial Access

• Password spraying against cloud identity and Exchange. T1110.003
• Stolen credentials and session cookies, likely purchased from criminal marketplaces and infostealer logs. T1078.004
• Adversary-in-the-middle phishing (from April 2025): a typosquatted domain spoofing the Microsoft Entra sign-in page, reached via a PDF with a malicious QR code, with Evilginx capturing credentials and session cookies. The lure impersonated a European defense and security summit. T1566.001 T1557 T1539

Post-Compromise Collection

• Exchange Online access, and sometimes SharePoint Online. T1114.002 T1530
• Microsoft Graph API abuse to enumerate and bulk-collect mailboxes, including shared mailboxes, and cloud files. T1119
• Occasional Microsoft Teams access via the web client.
• AzureHound used in some cases to enumerate Entra ID users, roles, groups, applications and devices. T1087.004

The character is high-volume, smash-and-grab cloud data collection rather than stealthy long-dwell tradecraft, with minimal bespoke malware observed.

MITRE ATT&CK Mapping

Notable Incidents

• Sep 2024 — Dutch National Police: work-related contact details of officers accessed; the pivotal case that led the Dutch services to identify the group.
• Oct 2024 — Ukrainian aviation: compromised accounts at an organisation previously targeted by the GRU actor Seashell Blizzard in 2022.
• Apr 2025 — NGO sector: more than twenty organisations in Europe and the US targeted in the Evilginx AitM spearphishing campaign.

Indicators of Compromise

Detection & Mitigation

• Enforce phishing-resistant MFA — FIDO2 security keys or passkeys — and avoid telephony-based MFA.
• Apply Conditional Access with sign-in risk policies, limit session-cookie lifetimes, and adopt token-theft mitigations such as token binding and Continuous Access Evaluation.
• Enable mailbox auditing, run non-owner mailbox-access reports, and monitor Graph audit logs for bulk-collection anomalies.
• Watch for password-spray patterns, impossible-travel sign-ins, stolen-cookie token replay, and AzureHound-style Entra ID enumeration.
• Rotate credentials after any infostealer infection on associated devices, and apply least privilege and centralised identity and device management.