Full Report
Denis Obrezko accused of orchestrating cyberattacks that compromised at least 11 U.S. companies as part of the Kremlin-linked group's sprawling espionage operation.\ The post Russian national charged in connection with Void Blizzard espionage campaign appeared first on CyberScoop.
Analysis Summary
# Threat Actor: Void Blizzard
## Attribution & Identity
* **Identified Individual:** Denis Nikolayevich Obrezko (Russian national).
* **Actor Name:** Void Blizzard.
* **Aliases:** Laundry Bear (tracked by Microsoft).
* **Associations:** Government-linked/state-sponsored Russian threat group; "Russia-aligned" espionage entity.
## Activity Summary
* **2024–2026 Operations:** Accused of orchestrating a sprawling espionage campaign compromising at least 11 U.S. companies.
* **September 2024:** Infiltration of the Netherlands’ national police force (confirmed by Dutch intelligence in May 2025).
* **April 2025:** Large-scale spear-phishing campaign targeting over 20 NGOs.
* **June–July 2024:** Identification of active intrusions against several American companies by the FBI and private sector partners.
## Tactics, Techniques & Procedures
* **Authentication Bypass:** Use of stolen session tokens to authenticate to victim accounts, successfully bypassing re-authentication/MFA requirements.
* **Anonymization & Geofencing Bypass:** Utilization of U.S.-based commercial proxy services and VPNs to mask connection origins. Specifically, the actor selects proxy IPs in the same geographic region as the target to evade geographic firewall restrictions.
* **Phishing:** Deployment of spear-phishing campaigns using typosquatted domains to spoof Microsoft authentication pages.
* **Reconnaissance & Enumeration:** Cataloging Microsoft Entra ID configurations to map organizational structures and accessing Microsoft Teams conversations for internal intelligence.
* **Exfiltration:** Harvesting bulk email and files from compromised cloud environments.
## Targeting
* **Sectors:** Defense suppliers, government agencies, critical infrastructure, educational institutions, non-governmental organizations (NGOs), and law enforcement.
* **Geography:** NATO member states, Ukraine, United States, and Europe (specifically the Netherlands).
* **Victims:** Dutch National Police; at least 11 unnamed U.S. companies.
## Tools & Infrastructure
* **Infrastructure:** Purchased Virtual Private Servers (VPS) and maliciously registered domain names.
* **Typosquatted Domains:**
* miscrsosoft[.]com
* micsrosoftonline[.]com
* **Connectivity:** Commercial proxy services and VPNs.
## Implications
The activities of Void Blizzard demonstrate that "unsophisticated" or basic intrusion techniques—such as session token theft and typosquatting—remain highly effective when executed at scale by state-sponsored actors. The focus on Entra ID and Microsoft Teams indicates a strategic interest in mapping organizational hierarchies and intercepting internal communications for long-term espionage.
## Mitigations
* **Session Management:** Implement shorter session lifespans and strict token revocation policies to mitigate the impact of stolen session tokens.
* **Identity Security:** Monitor Microsoft Entra ID (formerly Azure AD) for unusual configuration changes or unauthorized bulk data exports.
* **Domain Monitoring:** Implement "look-alike" or typosquatting domain monitoring to alert users to spoofed authentication pages.
* **Conditional Access:** Utilize robust Conditional Access policies that go beyond simple geography, including device health checks and behavioral analytics.
* **Employee Awareness:** Conduct specialized training on identifying sophisticated phishing attempts that mimic internal authentication portals.