Loading threat actor…
Laundry Bear is a Russian state-supported cyberespionage actor active since at least 2024, also tracked as Void Blizzard, TA488, UAC-0190, CL-STA-1114, and UNK_PitStop. Its operations target Western governments and commercial organizations, particularly in NATO member states and Ukraine. Targeted sectors include government, military and defense, technology and digital services, energy, telecommunications, finance, hospitality, education, media, and civil society. Its principal objective is intelligence collection through sustained access to email, cloud-hosted files, and organizational communications. The actor uses spearphishing, password spraying, stolen session cookies and tokens, and living-off-the-land techniques. It has replayed stolen session tokens to access Microsoft 365 and other cloud environments, using geographically proximate proxies to evade location-based access controls. Compromised accounts also support follow-on phishing and additional collection. Beginning by July 2025, Laundry Bear exploited CVE-2025-66376, a stored cross-site scripting vulnerability in Zimbra Collaboration Suite, to deliver the ZimReaper JavaScript implant. Opening or previewing a malicious email in vulnerable webmail triggered execution within the authenticated browser session without requiring a link click or attachment. ZimReaper stole credentials and authentication material, enumerated organizational address directories, exported the preceding 90 days of email, and created application-specific passwords that enabled persistent mailbox access without two-factor authentication. The associated Zimbra capability has also been identified as Ulej. In July 2026, the actor used CVE-2026-42897 against on-premises Microsoft Exchange Outlook Web Access to deploy OWAReaper. This browser-resident implant captures saved credentials and OAuth tokens, collects mailbox information, and establishes persistence through browser storage, poisoned offline message caches, and server-side mailbox permission changes. Its mailbox permission modifications can preserve unauthorized access despite password changes or endpoint rebuilding. OWAReaper receives commands through GitHub commit messages and specially formatted emails, and exfiltrates information through HTTPS channels, legitimate image delivery services, and DNS tunneling. Obfuscation, browser-based execution, and removal of exploit content from messages reduce conventional endpoint visibility.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
46 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
11 malware families attributed to this actor across reporting.
6 additional families tracked in Mallory.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
220 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.