Dutch intelligence agencies AIVD and MIVD, alongside Microsoft Threat Intelligence, have identified Laundry Bear also tracked as Void Blizzard as a sophisticated Russian state-sponsored advanced persistent threat (APT) group active since at least April 2024.
This actor has focused on espionage operations against NATO countries, Ukraine, and various organizations including the Dutch police, a Ukrainian aviation entity, and European and US non-governmental organizations (NGOs).
Leveraging stolen credentials, session cookies, and spear-phishing campaigns via typosquatted domains such as micsrosoftonline[.]com, Laundry Bear employs initial access vectors that mimic legitimate services to facilitate intelligence gathering.
Initial reporting highlighted just three indicators: micsrosoftonline[.]com (used for Evilginx-based phishing), ebsumrnit[.]eu (a malicious sender domain imitating ebsummit[.]eu), and outlook-office[.]micsrosoftonline[.]com.
However, advanced pivoting techniques utilizing DNS history, host response analysis, and regular expression searches in tools like Validin have uncovered a broader infrastructure, revealing patterns of domain registration, redirection tactics, and shared hosting that extend the threat’s footprint.
Laundry Bear’s operations demonstrate meticulous domain manipulation, with lookalike registrations on PDR Ltd. using privacy-preserving emails from onionmail[.]org and aficors[.]com, often configured with Mailgun for email delivery and Cloudflare for name servers.
For instance, regex-based hunts identified additional ebsummit[.]eu variants like ebsurnmit[.]eu and ebsummlt[.]eu, registered in April-May 2025, some redirecting to benign sites before being flagged as phishing.
Pivoting from host response hashes, such as SHA1 38c47d338a9c5ab7ccef7413edb7b2112bdfc56f (a JavaScript redirect to outlook[.]live[.]com), linked to eight apex domains including micator-secure[.]com and maidservant[.]shop, exposing subdomains themed around login and authentication.
Further analysis of IP overlaps, like 104.36.83[.]170, connected to logistics-themed phishing pages and lookalikes such as walshhgroup[.]com, which redirected to potentially malicious PDFs on non-standard ports, aligning with reported tactics.
Historical DNS records showed suspensions and rickrolling redirects, possibly indicating sinkholing or actor evasion, while certificate pivots (e.g., SHA1 ade08cd340765e68f65174820b46c0e3d9b52ab4) tied domains across AWS and DigitalOcean ASNs.
Expanding beyond initial indicators, investigations into body hashes like 2c0fa608bd243fce6f69ece34addf32571e8368f uncovered 14 domains since November 2024, including it-sharepoint[.]com, with subdomains resolving to IPs like 34.204.123[.]157 shared among government and corporate lookalikes such as spidergov[.]org and deloittesharepoint[.]com.
Timeline views illustrated infrastructure shifts across ASNs like 14061 (DigitalOcean) and 14618 (AWS), highlighting Laundry Bear’s adaptability in deploying redirectors and self-signed certificates for persistence.
These findings underscore the group’s use of CNAME chaining, SMTP services like SMTP2GO, and thematic subdomains (e.g., login, okta, microsoftonline) to blend into legitimate traffic, enabling credential theft and lateral movement.
Such depth in pivoting encompassing HTTP responses, registration similarities, and lookalike patterns reveals an evolving campaign potentially halted by public disclosures, yet poised for resurgence.
Cybersecurity teams are urged to monitor these indicators for proactive defense against this Russian-affiliated espionage threat.
| Category | Indicators |
|---|---|
| Commonly Observed Subdomains | login, email, account, okta, live, csp, sso, reporting, microsoftonline, mail, cdn |
| E2LDs Discovered | redronesolutions.cloud, ourbelovedsainscore.space, weblogmail.live, microffice.org, spidergov.org, portal-microsoftonline.com, micsrosoftonline.com, micator-secure.com, remerelli.com, myspringbank.com, propescom.com, defraudatubanco.com, m-365-app.com, max-linear.com, app-v4-mybos.com, miscrsosoft.com, it-sharepoint.com, deloittesharepoint.com, mail-forgot.com, x9a7lm02kqaccountprotectionaccountsecuritynoreply.com, maidservant.shop, teamsupportonline.top, aoc-gov.us, bidscale.net, refundes.net, avsgroup.au, ebsum.eu, ebsumlts.eu, ebsurnmit.eu, ebsumrnit.eu, ebsummlt.eu, ebsummt.eu |
| Related IP Addresses | 3.64.201.107, 3.126.53.226, 5.230.36.62, 34.204.123.157, 54.144.139.77, 64.23.244.176, 64.226.126.33, 52.78.180.48, 54.167.184.45, 104.168.144.21, 154.216.18.83, 170.64.163.105, 170.64.209.129, 176.97.124.54 |
Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…