Loading story…
Dutch intelligence services AIVD and MIVD attributed cyber operations against Dutch targets and other Western governments to the previously unidentified Russian-linked threat actor Laundry Bear. Active since at least 2024, the group has targeted military organizations, government bodies, defense suppliers, civil-society organizations, and digital service providers.
Laundry Bear uses widely available intrusion techniques including password spraying, theft of session cookies, and living-off-the-land activity that abuses legitimate system tools. The agencies urged organizations in the identified sectors—and other potential targets—to apply the mitigations in their joint technical publication and strengthen defenses against credential-based compromise and session hijacking.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
AIVD and MIVD assess that the Russian-linked threat actor Laundry Bear has conducted cyber operations against Western governments since 2024, with particular interest in military organizations, government bodies, defense suppliers, social organizations, and digital service providers.
The Dutch intelligence services published a full report and technical report on Laundry Bear, documenting techniques including password spraying, session-cookie theft, and living-off-the-land activity, and recommending mitigations for affected sectors and other organizations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A joint government advisory says Russia’s GRU Unit 26165, also tracked as **APT28** or **Fancy Bear**, has run a sustained cyberespionage campaign against Western logistics providers, technology companies, and defense supply-chain organizations supporting aid flows to Ukraine. The activity has affected entities in the United States, Germany, Poland, France, and Ukraine, with intrusions aimed at transportation networks, IT services, and military-related logistics. Officials said the operators also sought visibility into aid movements by compromising internet-connected IP cameras positioned near border crossings, rail hubs, and military facilities. Authorities linked the campaign to long-running GRU tradecraft previously used against governments, militaries, defense contractors, and cloud and email environments including Microsoft Office 365 and on-premises Exchange. Reported access methods include password spraying, brute-force and credential-guessing attacks, spearphishing, exploitation of known vulnerabilities including `CVE-2020-0688` and `CVE-2020-17144`, and the use of malware such as **HEADLACE** and **MASEPIE**, alongside web shells, Tor, VPNs, and living-off-the-land techniques to persist and exfiltrate data. Agencies warned the espionage effort remains active and urged organizations to enforce MFA, patch exposed systems, tighten access controls, monitor for lateral movement, and review supply-chain risk.
Jun 29, 2026
Researchers detailed two active Russia-linked threat operations using different intrusion models to target Western organizations. **TA577**, a phishing group active since 2020, was observed sending HTML attachments that force outbound SMB connections to `file://` URLs in order to capture **NTLMv2** authentication handshakes and steal credential hashes. Infrastructure hunting tied the campaign to a narrowed set of likely servers identified through Impacket-like 8-character SMB target names, a distinctive SMB server GUID, shared SSH banner hashes, and recurring hosting patterns across providers including **GLOBALWAYS**; some hosts also exposed a **"We’ll back soon.."** page, login panels, or default Apache pages. A separate analysis examined **NoName057(16)**, a pro-Russian hacktivist collective that has sustained disruptive attacks against Western targets, especially Italian banks, government entities, military infrastructure, and public administrations. The group operates a volunteer-driven DDoS ecosystem known as **DDosia** or **People Go Stresser 2.0**, combining attack tools, support channels, operational guidance, and cryptocurrency rewards to coordinate participants. Its operations primarily use Layer 7 HTTP floods and Layer 4 TCP-SYN attacks, with most traffic aimed at **TLS/443** services but also hitting SSH, FTP, and secure email ports; researchers also noted prior links between the collective and **Bobik RAT** infections used to support DDoS activity.
Jul 12, 2026
Recorded Future’s Insikt Group reported sustained **credential-harvesting operations by Russia-linked APT28** (aka **BlueDelta/Fancy Bear**) targeting individuals tied to a Turkish energy and nuclear research agency, European think tanks, and organizations in **North Macedonia and Uzbekistan**. Activity observed from **February to September 2025** used regionally tailored lures aligned with Russian intelligence priorities around energy, defense, and policy, with victims redirected to legitimate sites after credential theft to reduce suspicion. The campaigns relied on **fake login portals** impersonating *Microsoft Outlook/OWA*, *Google*, and *Sophos VPN* to capture credentials, and used low-cost, resilient infrastructure including free hosting and tunneling services (e.g., `ngrok`, Webhook[.]site, InfinityFree, and Byet Internet Services) to host pages and exfiltrate data. Multiple operations incorporated **legitimate PDF lure documents** (e.g., think tank and foundation publications) to increase authenticity and bypass email security controls, reflecting continued emphasis on scalable credential theft rather than novel malware deployment.
Jun 29, 2026