Loading story…
Microsoft identified Void Blizzard as a Russia-affiliated threat actor conducting espionage against organizations in critical sectors, describing activity focused on intelligence collection rather than disruptive attacks. The group was reported targeting victims of strategic interest and using operations aligned with state-backed collection priorities, adding a new tracked actor to the roster of Russian cyber-espionage threats.
Additional reporting tied Void Blizzard more directly to the Russian state, highlighting evidence of the group’s Russian links and reinforcing its role as an espionage operator. Taken together, the reports portray Void Blizzard as a state-aligned cyber actor targeting sensitive organizations for intelligence gathering, underscoring the risk to government, defense, and other high-value sectors.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Ctrl-Alt-Intel released research titled "Burnt by Burgers: Highlighting Void Blizzard’s Russian State Links," adding reporting focused on the group's ties to the Russian state. This represents a public attribution-related development concerning the actor.
Microsoft published research naming Void Blizzard as a new Russia-affiliated threat actor and described it as targeting critical sectors for espionage. The report established the actor's focus on espionage activity against organizations of interest.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
ctrlaltintel.com
Open sourcectrlaltintel.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. prosecutors charged Russian national **Denis Nikolayevich Obrezko** with conspiracy to commit unauthorized computer access for allegedly providing infrastructure used by the Kremlin-linked espionage group **Void Blizzard**, also tracked as **Laundry Bear**. After his transfer from Thailand to Boston, Obrezko appeared in federal court over accusations that he bought a virtual private server and internet domains through cryptocurrency transactions that enabled intrusions against U.S. and foreign targets. Thai authorities arrested him in Phuket during a joint operation with the FBI and seized laptops, mobile phones, and cryptocurrency wallets. An unsealed FBI affidavit says investigators confirmed compromises at **11 U.S. companies** between June and July 2024, while assessing that the real number of victims is likely higher. Authorities and researchers said Void Blizzard has targeted government, defense, transportation, media, healthcare, educational institutions, NGOs, critical infrastructure, and organizations across Europe, North America, NATO countries, and Ukraine, using stolen credentials, session tokens, VPNs, and U.S.-based proxy services to evade detection. The group has also been linked to spear-phishing with typosquatted Microsoft-themed domains such as `miscrsosoft[.]com` and `micsrosoftonline[.]com`, and to theft of Dutch police staff contact information.
Jun 29, 2026
The U.S. Justice Department and Microsoft disrupted infrastructure used by **Star Blizzard**, a Russia-linked threat group tied to the FSB, by seizing more than 100 internet domains used in spear-phishing and credential-theft operations. Federal investigators obtained a warrant for **41 domains**, while Microsoft secured a civil court order covering **66 more**, targeting infrastructure allegedly operated by the group also known as **Callisto Group**, **COLDRIVER**, and **SEABORGIUM**. Authorities said the domains were used to impersonate trusted contacts and lure victims into surrendering credentials or granting access to email accounts and computers. U.S. officials said the campaign targeted government personnel, former intelligence officials, Department of Defense and State employees, defense contractors, Department of Energy staff, journalists, think tanks, NGOs, and other civil society organizations. The Justice Department said the operation sought sensitive information related to U.S. defense, foreign affairs, and nuclear energy research, while Microsoft reported that Star Blizzard had targeted at least **82 customers** and more than **30 civil society organizations** since 2023, at a pace of roughly one attack per week. The disruption was presented as part of a broader effort to blunt Russian intelligence collection and reduce the risk of interference affecting democratic institutions and public-interest groups.
Jun 29, 2026
Anthropic said it disrupted an AI-enabled cyberespionage campaign, tracked as **GTG-20006** and assessed as consistent with Russian state-linked **Midnight Blizzard**, that operated from December 2025 through August 2026. The operators allegedly used Claude agents to automate reconnaissance, phishing, exploitation, lateral movement, data theft, and an iterative malware-evasion loop: testing tools against security products, modifying and rebuilding detected code, then redeploying it. More than 20 government, defense, intelligence, diplomatic, think-tank, drone-industry, hospitality, and surveillance targets across Ukraine, Europe, the Middle East, Asia, and North Africa were reportedly targeted; theft included drone-maker mailboxes and a proprietary drone-vision SDK. Reported activity also included DNS hijacking via hotel Wi-Fi vendors and WhatsApp-account takeovers. Anthropic said other disrupted abuse included ShinyHunters-associated credential harvesting and Android-package analysis, a SaaS supply-chain intrusion affecting more than 200 downstream organizations, suspected Chinese-linked exploit research, and politically motivated theft and doxxing. The company warned that AI API keys, session tokens, and AI-integrated services are increasingly valuable targets because stolen access can be resold, provide victim-funded compute, and obscure attacker attribution. Anthropic banned involved accounts, strengthened misuse controls, and shared relevant indicators with law enforcement and industry partners.
Sep 11, 2026