Void Blizzard

Summary

Russian state-backed espionage actor named jointly by Microsoft Threat Intelligence and the Dutch services AIVD/MIVD on 27 May 2025 — Microsoft as Void Blizzard, the Dutch as LAUNDRY BEAR. Active since at least April 2024. Proofpoint equates its TA488 (formerly UNK_PitStop) with Void Blizzard and Laundry Bear; Unit 42 says only that its CL-STA-1114 cluster overlaps this actor, and the July 2026 joint advisory notes that vendor groupings may not be 1:1, so CL-STA-1114 is recorded as an overlap, not an alias. The Void Blizzard / LAUNDRY BEAR pairing itself is authoritative, named jointly by the two agencies that disclosed it. Baseline tradecraft is high-volume and low-sophistication: password spray and credentials bought from the commodity infostealer ecosystem against Microsoft 365, with Evilginx adversary-in-the-middle phishing on typosquatted domains added from April 2025, then cloud-native collection through Exchange Online and Microsoft Graph, the Teams web client, and AzureHound for Entra enumeration. From July 2025 the actor ran a far more capable campaign against Zimbra Collaboration Suite, exploiting CVE-2025-66376 — a stored XSS in the Classic UI reachable by simply viewing a crafted HTML email, described as zero-click or half-click. The payload used tag-splitting (fake @import directives and HTML comments fragmenting an svg onload tag) to defeat Zimbra's sanitiser, and exfiltrated the last 90 days of mail, browser-saved passwords, two-factor recovery codes, the organisation's email directory, CSRF tokens and the Zimbra version. NVD scores it 6.1 and MITRE 7.2, disagreeing on whether user interaction is required. Fixed in 10.0.18 and 10.1.13 in November 2025; exploitation of unpatched servers continued. A joint advisory from NSA, FBI, CISA and agencies in the Netherlands, UK, Australia, Canada and a dozen other countries was published in July 2026. Proofpoint saw no activity from February 2026 until 22 July 2026, when TA488 resumed with a half-click Exchange OWA XSS (CVE-2026-42897, possibly as a zero-day) loading OWAReaper, a JavaScript implant in the OWA reading pane that evolved from ZimReaper, against US and European government and industry. Backend infrastructure is a Docker-based system the advisory calls Flowerbed, with a Catcher container handling DNS and HTTP, accessed over Mullvad VPN and rotated every 7–60 days. The Dutch services attribute the September 2024 compromise of the Netherlands National Police to this actor.

Attribution

No specific service named

Named by a government: indictment, sanctions designation, joint advisory or official statement.

• CISA, NSA, FBI and partners (AA26-204A) (Government, 2026-07-23)
  Joint advisory on its Zimbra zero-day campaign names it a Russian state-supported group
• Proofpoint (Research, 2026-07-23)
  Tracks it as Russia-aligned TA488

Campaigns 4

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 15

Malware and tools 7

Exploited vulnerabilities 2

Highest CVSS first.

Infrastructure patterns

• Flowerbed collection framework on procured cloud servers, deployed as Docker containers (CISA et al., 2026)
• Nginx container as HTTPS reverse proxy for the Catcher collector (CISA et al., 2026)
• Mullvad VPN when interacting with its servers (CISA et al., 2026)
• Typosquatted domain spoofing Microsoft Entra sign-in, served through Evilginx (Microsoft, 2025)

Reporting and advisories 5

• NSA / FBI / CISA + NL, UK, AU, CA
  Joint advisory AA26-204A — Russian state-supported actors targeting Zimbra Collaboration Suite (Jul 2026)
• Microsoft
  New Russia-affiliated actor Void Blizzard targets critical sectors for espionage (27 May 2025)
• AIVD / MIVD
  Public report on new Russian cyber actor LAUNDRY BEAR (May 2025)
• Proofpoint
  Zimbra zero-day espionage campaign (CVE-2025-66376)
• Proofpoint
  OWAReaper — Exchange OWA half-click XSS (CVE-2026-42897) against US/European government and industry