Void Blizzard, also known as Laundry Bear, is a Russian-affiliated cyberespionage group active since April 2024. It targets organizations aligned with Russian strategic interests, focusing on sectors such as government, defense, transportation, media, NGOs, and healthcare in Europe and North America. The group’s operations are characterized by opportunistic, high-volume attacks aimed at collecting intelligence, particularly from NATO member states and Ukraine. Void Blizzard employs unsophisticated techniques like password spraying and stolen authentication credentials, often acquired from online marketplaces. They leverage these methods to access systems such as Exchange and SharePoint Online, where they harvest large amounts of emails and files. Additionally, the group uses tools like AzureHound to gather detailed information about compromised organizations’ Microsoft Entra ID configurations. Recent activities include shifting to direct methods for stealing passwords, such as spear-phishing emails with adversary-in-the-middle (AitM) landing pages. These emails impersonate legitimate entities, using typosquatted domains to deceive victims and capture login information. The group has targeted over twenty (20) NGOs in Europe and the US, with phishing pages hosted on domains like “micsrosoftonline[.]com.” Void Blizzard’s actions overlap with other Russian state actors, such as Forest Blizzard, Midnight Blizzard, and Secret Blizzard, indicating shared espionage objectives. In September 2024, they breached a Dutch police employee account using a pass-the-cookie attack, obtaining work-related contact information. The Netherlands Defence Intelligence and Security Service (MIVD) linked this breach to Void Blizzard and warned of potential targeting of other Dutch organizations. The group’s focus includes gathering information on military equipment purchases and Western weapon supplies to Ukraine. Void Blizzard’s ongoing activities pose significant risks to critical sectors in NATO member states.