Void Blizzard

THREAT ACTOR PROFILE

Void Blizzard

Laundry Bear

Void Blizzard is a Russian espionage group focused on webmail and email theft against government, defense, telecom and finance targets across NATO countries, Ukraine and the CIS. It exploits zero-click and view-based flaws in webmail platforms like Zimbra and Exchange OWA, then exfiltrates mailboxes, contacts and 2FA codes to purpose-built infrastructure.

Country:

Russia

Government / Defense / Telecom

First seen

2024

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

Void Blizzard, Laundry Bear and overlapping clusters

Void Blizzard is tracked under several vendor names, with research clusters that overlap in targeting and tooling. It maps to one entry among the Russian espionage groups we track, and its email-theft focus overlaps with other Russian crews like APT29.

GROUP PROFILE

Zero-click webmail theft at scale

Void Blizzard is an espionage actor built around stealing email. Rather than noisy intrusions, it targets the webmail platforms organizations expose to the internet, using zero-click and view-based exploits that trigger when a victim simply opens or renders a crafted message.

Our record places its origin as Russia and ties it to espionage against government, defense, transportation, telecom and finance targets across NATO countries, Ukraine, the CIS and Africa. US agencies issued advisories on the Laundry Bear Zimbra campaign.

The group's tradecraft centers on webmail XSS flaws, custom exfiltration tools like Ulej and the OWAReaper implant, adversary-in-the-middle phishing, and data staging to infrastructure tracked as Flowerbed.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

Crafted emails into mailbox exfiltration

The stages below come from Void Blizzard, Laundry Bear and overlapping-cluster activity in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

OWAReaper, Ulej and webmail implants

Initial Access

CVES EXPLOITED

Zimbra and Exchange webmail zero-days

CVE-2026-21509

A Microsoft Office security bypass used to open the fileless chain in Operation Neusploit, and again in the PixyNetLoader intrusion chain. Both campaigns paired the exploit with spear-phishing from compromised accounts rather than mass exploitation.

CVE-2026-21509

RECENT {{name}} IOCS

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

Zimbra and Exchange OWA campaigns

Recent reporting tracks the group's webmail exploitation.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through