Void Blizzard / Laundry Bear threat actor profile: Cloud credential theft, detections and defences

Void Blizzard gets into government and defence mailboxes with the cheapest tools available: password spraying, credentials and session cookies bought through criminal markets, and an off-the-shelf adversary-in-the-middle phishing kit. Microsoft Threat Intelligence named the group in May 2025, assessed with high confidence that it is Russia-affiliated, and lists LAUNDRY BEAR as an alias, crediting collaboration with the Dutch intelligence services AIVD and MIVD. This profile sets out who the group is, its targets, the ATT&CK techniques it uses, how it abuses cloud identities and tokens, and the Entra ID and Microsoft 365 detections and controls that counter it. It is written for Microsoft 365 administrators, SOC analysts and threat intelligence teams in government, defence, NGOs and their suppliers.

Key takeaways

• Low sophistication, high impact. Microsoft describes most of the group's access as relying on unsophisticated methods such as password spraying and stolen credentials, which makes basic identity hygiene the decisive control.
• Stolen cookies skip MFA. Microsoft assesses that the actor procures cookies and other credentials through criminal ecosystems, with stolen credentials likely coming from commodity infostealer markets; a replayed session cookie needs no password or MFA prompt.
• AitM phishing arrived in April 2025. The group targeted more than 20 NGO-sector organisations with a fake European Defense and Security Summit invitation, a PDF with a QR code, a typosquatted Entra sign-in domain and, in Microsoft's assessment, the Evilginx kit.
• The goal is bulk collection. After access the actor uses Exchange Online and Microsoft Graph to enumerate and download mail (including shared mailboxes) and files, reads Teams messages in some cases, and maps the tenant with AzureHound.
• Entra ID Protection has named detections for each step. Password spray, Attacker in the Middle, Anomalous token, Anonymous IP address and Suspicious API traffic map directly to this actor's tradecraft.

Who they are (names and aliases)

Void Blizzard is a Microsoft designation; in Microsoft's naming system "Blizzard" denotes Russia. Microsoft assesses with high confidence that the group is Russia-affiliated and has been active since at least April 2024. Microsoft lists LAUNDRY BEAR as an alias and credits the Netherlands' General Intelligence and Security Service (AIVD) and Defence Intelligence and Security Service (MIVD) for collaboration. This profile could not read the Dutch services' own publication on the group, so details reported only there are not included.

Microsoft notes that Void Blizzard's targets overlap with those of other Russian state actors it tracks, Forest Blizzard, Midnight Blizzard and Secret Blizzard, which it reads as shared intelligence requirements rather than as the same group. As of ATT&CK v20, MITRE has no group entry for Void Blizzard or Laundry Bear. See the Russia State Cyber Operations Guide and the Threat Actor Naming Conventions Guide.

Targeting and motivation

The motive is espionage. Microsoft lists government, defence, transportation, media, NGOs and healthcare among targeted sectors, along with communications, the defence industrial base, education, IT and intergovernmental organisations. Activity is mainly in Europe and North America, with a disproportionate focus on NATO member states and Ukraine, and the group often targets government and law enforcement agencies in countries that provide military or humanitarian aid to Ukraine.

Tactics and techniques (MITRE ATT&CK)

Microsoft's report includes no ATT&CK mapping. The table below is ours, from the behaviour Microsoft documented, checked against ATT&CK v20.

How they abuse identities and credentials

• Infostealer supply chain: the group buys access rather than building it. A credential or cookie stolen from a staff member's home computer becomes a tenant login. See the Infostealer Logs and Session Token Abuse Guide.
• Password spraying: a few common passwords tried across many accounts, which succeeds wherever legacy protocols or accounts without MFA remain. See the Password Spraying and Credential Stuffing Defence Guide.
• Session token capture: Evilginx sits between the user and the real sign-in page and captures the session token after MFA succeeds, so push, SMS and one-time code MFA do not help. See the AiTM Phishing Guide and the QR Code Phishing (Quishing) Guide.
• Graph as the collection channel: once a token is held, Microsoft Graph and Exchange Online APIs allow programmatic mailbox and file access, including shared mailboxes the user can open. Shared and service mailboxes often hold more than any single user's inbox.
• Directory mapping: AzureHound output tells the actor which users hold privileged roles, which applications have powerful permissions and which service principals to target next. Application and service principal permissions are part of the attack surface; see the Entra ID Applications and Consent Guide.

Notable incidents

• Ukrainian aviation organisation, October 2024: accounts compromised at an organisation that Seashell Blizzard had targeted in 2022, according to Microsoft.
• NGO phishing campaign, April 2025: more than 20 NGO-sector organisations in Europe and the United States targeted with the fake summit lure.
• Government and law enforcement: Microsoft reports frequent targeting of government and law enforcement agencies in countries supporting Ukraine, without naming victims.

No breach analysis page on this site is attributed to Void Blizzard, so none is linked.

Detection and defence

Detections Microsoft lists

Microsoft also lists Defender for Cloud "AzureHound tool invocation detected", Defender for Cloud Apps impossible travel and unusual activity alerts, and Defender for Identity unfamiliar sign-in properties and atypical travel. Detections differ by licence, so confirm which you actually receive.

Hunting

• Spray patterns: many accounts failing sign-in from a small set of addresses, followed by a success.
• Lookalike domains: clicks or DNS lookups for domains resembling login.microsoftonline.com, especially after QR codes in PDF attachments.
• Bulk mailbox access: enable mailbox auditing and run non-owner mailbox access reports in the Exchange admin center; look for Graph mail reads at volume from new sessions.
• Directory enumeration: bursts of Graph calls listing users, groups, roles, applications and devices from a user session that normally does none.
• Teams web access: Teams web client sessions from unfamiliar locations for users who normally use the desktop client.

See the Entra ID Sign-In and Audit Log Detection Guide.

Prevent

• Phishing-resistant MFA: FIDO2 security keys or passkeys defeat AitM proxies because the credential is bound to the real origin; avoid telephony factors. See the Phishing-Resistant MFA Guide.
• Sign-in risk policies: use risk-based Conditional Access to block or challenge risky sign-ins and require compliant devices for sensitive data.
• Block legacy authentication: removes protocols that let sprayed passwords work without MFA.
• Rotate after infostealer infections: treat every credential and session on an infected device as stolen, revoke sessions and reset passwords. See the Infostealer Logs Monitoring and Response Guide.
• Least privilege for mailboxes and roles: review who can open shared mailboxes and who holds directory roles that AzureHound would reveal.

Respond

1. Revoke the user's sessions and refresh tokens and reset the password.
2. Review sign-in logs for the token's first use, source addresses and devices.
3. Pull mailbox audit and Graph activity to scope mail, files and Teams messages accessed.
4. Check for new MFA methods, inbox rules, application consents or app credentials added during the session.
5. Notify partners whose correspondence was in the mailbox, as government and NGO targets often share data across organisations.

Metrics

• Percentage of users with phishing-resistant MFA, starting with privileged and external-facing roles.
• Number of successful sign-ins using legacy authentication (target zero).
• Median time from an Attacker in the Middle or Anomalous token detection to session revocation.
• Percentage of mailboxes with auditing enabled and reviewed.
• Number of accounts appearing in infostealer monitoring and rotated within 24 hours.

Framework mapping

Practitioner checklist

• Enforce phishing-resistant MFA for privileged, executive and externally exposed staff first.
• Block legacy authentication tenant-wide and confirm with sign-in logs.
• Enable sign-in and user risk policies and confirm which Entra ID Protection detections your licence includes.
• Turn on mailbox auditing and schedule non-owner mailbox access reports.
• Alert on AzureHound-style directory enumeration and bulk Graph mail reads.
• Subscribe to infostealer log monitoring for your domains and revoke sessions on any hit.
• Brief staff on QR code lures in event invitations and lookalike Microsoft sign-in domains.
• Review shared mailbox membership and directory role assignments quarterly.

Standards and references

• Microsoft Threat Intelligence: New Russia-affiliated actor Void Blizzard targets critical sectors for espionage
• Microsoft Learn: What are risk detections? (Microsoft Entra ID Protection)
• MITRE ATT&CK: Adversary-in-the-Middle
• MITRE ATT&CK: Brute Force: Password Spraying
• MITRE ATT&CK: Use Alternate Authentication Material: Web Session Cookie
• MITRE ATT&CK: Email Collection: Remote Email Collection
• NIST: SP 800-53 Rev. 5
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: AiTM Phishing Guide · Infostealer Threat Guide · Storm-2372 (device code phishing) threat actor profile · APT29 (Midnight Blizzard) Threat Actor Profile · Threat Actor Groups Guide