Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Void Blizzard · Unknown · assessed origin Russia · misp-galaxy · refreshed 2026-10-06

Void Blizzard

  • LAUNDRY BEAR
  • UAC-0190
  • TA488
  • Laundry Bear

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. 2026-09-071 mo agonew CVE2 new CVEs: CVE-2025-66376, CVE-2026-42897

Analyst brief

misp-galaxy

Void Blizzard’s cyberespionage operations tend to be highly targeted at specific organizations of interest to the Russian government, including in government, defense, transportation, media, non-governmental organizations (NGOs), and healthcare sectors primarily in Europe and North America. The threat actor uses stolen credentials—which are likely procured from commodity infostealer ecosystems—and collects a high volume of email and files from compromised organizations.

CVEs cited sources tie to Void Blizzard

1 on CISA KEV
  1. CVE-2026-42897KEV2026-07-30
    1. “On 22 July 2026 (the day prior to Proofpoint’s joint release with the NSA), TA488 initiated a new wave of exploitation abusing a cross-site scripting (XSS) vulnerability, CVE-2026-42897, in Outlook Web Access (OWA).”

      cited as exploiting · source: proofpoint.com ↗ · 2026-10-17

    2. “Russia-affiliated cyber espionage group Laundry Bear (aka Void Blizzard, aka TA488) is exploiting CVE-2026-42897, a cross-site scripting vulnerability in Microsoft Exchange, to target US and European government entities and a variety of private sector organizations via email.”

      cited as exploiting · source: helpnetsecurity.com ↗ · 2026-10-17

    3. “Laundry Bear’s new Microsoft Exchange attack triggers on email open (CVE-2026-42897) Russia-affiliated cyber espionage group Laundry Bear (aka Void Blizzard, aka TA488) is exploiting CVE-2026-42897, a”

      attributed by a report · named nearby · source: our dispatch · 2026-07-30

  2. CVE-2025-663762026-07-25
    1. “TA488 (Void Blizzard, Laundry Bear) was exploiting a previously unknown vulnerability against Zimbra mailservers for at least five months during 2025, until the issue was patched with CVE-2025-66376.”

      attributed by a report · named nearby · source: our dispatch · 2026-07-25

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

4 sources
  1. 1.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-a…
  2. 2.aivd.nl/actueel/nieuws/2025/05/27/onbekende-russische-groep-ac…
  3. 3.cert.gov.ua/article/6286942
  4. 4.proofpoint.com/us/blog/threat-insight/cleaning-out-inboxes-ta488-come…

Track Void Blizzard on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.