Russian National Charged Over Void Blizzard Espionage Campaign
Summary
U.S. prosecutors charged Denis Nikolayevich Obrezko over alleged support for Void Blizzard espionage. The FBI says it verified intrusions at 11 U.S. companies; investigators describe stolen session tokens, proxies and typosquatted Microsoft domains.
Key points
- Obrezko was charged with conspiracy to commit unauthorized computer access and is accused of purchasing a server and domains used in attacks.
- The FBI verified intrusions at 11 U.S. companies; the affidavit says that figure may represent only a fraction of the nationwide victims.
- Investigators say the group used stolen session tokens to access victim accounts, then routed traffic through VPNs and commercial proxies to mask its location and evade geographic firewall restrictions.
- The campaign targeted businesses, educational institutions and other organizations; Microsoft identifies Void Blizzard, also known as Laundry Bear, as a Russian state-sponsored threat group.
- The group has been observed harvesting bulk email and files from cloud environments, accessing Microsoft Teams conversations and cataloging Microsoft Entra ID configurations.
- Microsoft attributed a 2025 spear-phishing campaign targeting more than 20 NGOs to Void Blizzard; the affidavit identifies typosquatted domains including miscrsosoft[.]com and micsrosoftonline[.]com.
Article Details
- Event Type
- Federal criminal charge connected to a cyber-espionage campaign
- Impact
- The FBI verified intrusions at 11 U.S. companies, and investigators said that was likely only a fraction of the nationwide victim count. The group was reported to have stolen work-related contact information from the Netherlands’ national police force and to have harvested email and files from compromised cloud environments, accessed Microsoft Teams conversations, and mapped Microsoft Entra ID configurations.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | micsrosoftonline[.]com | Typosquatted domain identified in connection with Void Blizzard's spear-phishing campaign spoofing Microsoft authentication pages. |
| DOMAIN | miscrsosoft[.]com | Typosquatted domain identified in connection with Void Blizzard's spear-phishing campaign spoofing Microsoft authentication pages. |
MITRE ATT&CK
T1090 · ProxyInvestigators said the group used a commercial proxy service and routed traffic through a VPN to mask connection locations.T1114 · Email CollectionThe group was reported to harvest bulk email from compromised cloud environments.T1566 · PhishingMicrosoft attributed a spear-phishing campaign to Void Blizzard that used typosquatted domains to spoof Microsoft authentication pages.
Threat Actors
Denis Nikolayevich ObrezkoA Russian national charged with conspiracy to commit unauthorized computer access. He is accused of breaking into company systems and facilitating the campaign by purchasing a virtual private server and domains used in attacks; these are allegations, not a finding of guilt.Laundry BearMicrosoft's alternate name for Void Blizzard, which is linked to the reported espionage campaign and spear-phishing activity.TA488The group is linked to the espionage campaign; investigators say it used stolen session tokens and proxy services, and Microsoft attributed a spear-phishing campaign using typosquatted domains to it. Microsoft also tracks the group as Laundry Bear.
Vendors
Products
Microsoft Entra IDThe group has been observed harvesting bulk email and files from compromised cloud environments, accessing Microsoft Teams conversations, and cataloging Microsoft Entra ID configurations to map organizational structures.Microsoft TeamsThe group has been observed harvesting bulk email and files from compromised cloud environments, accessing Microsoft Teams conversations, and cataloging Microsoft Entra ID configurations to map organizational structures.
Countries
Netherlandsintelligence and security services separately confirmed in May 2025 that the group had infiltrated the Netherlands’ national police force in September 2024, stealing work-related contact information on police staff.Russiacommit unauthorized computer access in connection with a sprawling cyber-espionage campaign linked to the Russia-aligned threat group Void Blizzard, according to a criminal complaint filed in federal court this week.Ukrainegovernment agencies, defense suppliers, and critical infrastructure providers across NATO member states, Ukraine, and beyond.United StatesInvestigators say the group targeted U.S.
Industries
Critical infrastructureconducting large-scale espionage operations against government agencies, defense suppliers, and critical infrastructure providers across NATO member states, Ukraine, and beyond.DefenseRussian threat group conducting large-scale espionage operations against government agencies, defense suppliers, and critical infrastructure providers across NATO member states, Ukraine, and beyond.GovernmentBear — as a state-sponsored Russian threat group conducting large-scale espionage operations against government agencies, defense suppliers, and critical infrastructure providers across NATO member states, Ukraine,Non-governmental organizationsa separate spear-phishing campaign attributed to Void Blizzard that targeted more than 20 non-governmental organizations in Europe and the United States, using typosquatted domains to spoof Microsoft authentication