Void Blizzard

☆ pin

MITRE G1014Also known as Laundry Bear, LAUNDRY BEAR, Void Blizzard, TA488, CL-STA-1114, UNK_PitStop

Reports

First seen

Dec 2, 2025

Last seen

Sep 17, 2026

Motivation

Espionage, Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Government ×7 Other ×5

Victim regions

×1

×2

United States×2

Ukraine×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1190 Exploit Public-Facing Application ×15T1566 Phishing ×14T1041 Exfiltration Over C2 Channel ×13T1005 Data from Local System ×8T1059 Command and Scripting Interpreter ×7T1110 Brute Force ×5T1566.002 Phishing: Spearphishing Message ×5T1486 Data Encrypted for Impact ×4T1078 Valid Accounts ×3T1203 Exploitation for Client Execution ×3T1555 Credentials from Password Stores ×3T1047 Windows Management Instrumentation ×3

Indicators

cve ×182domain ×43email ×21filename ×13ip_v4 ×11hash_sha1 ×10url ×10hash_sha256 ×5

Indicator values are available on Pro and via the API.

Recent reports

High

Void Blizzard

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories

Zimbra SNMP Command Injection Flaw Under Active Exploitation

Russian State-Sponsored Group Laundry Bear Exploits Zimbra Flaw to Steal Emails Without User Interaction

Weekly Cybersecurity Recap: AI Model Breaches, Water-System Attacks, Ransomware, and Critical Vulnerabilities

Cyber Brief July 2026 – EU Threat Intelligence Summary

Russian Hackers Exploit Microsoft OWA Flaw to Maintain Persistent Mailbox Access

Russian Laundry Bear exploits Exchange OWA zero-day for persistent mailbox access

Laundry Bear exploits Microsoft OWA vulnerability with sophisticated OWAReaper implant

Weekly Threat Recap: AI Breach at Hugging Face, Check Point Exploit, Ransomware Campaigns, and Emerging Attack Vectors

Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks

Russian espionage group exploiting Zimbra zero-day to steal sensitive data from Western governments and organizations

Russia-linked Laundry Bear targets Zimbra webmail across NATO and Ukraine

Russian Laundry Bear exploits Zimbra zero-click XSS flaw to steal emails and credentials

Russian APT Laundry Bear Exploits Zimbra Zero-Day for Espionage Against Western Governments

Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Zimbra Collaboration Suite

Russian national charged in Void Blizzard espionage campaign

Russian national linked to Void Blizzard charged in U.S. cyberespionage campaign

2025 Cloud Threat Hunting and Defense Landscape

Cyber Brief November 2025: Operation Endgame, Sandworm Wipers, China AI Espionage