UnknownPublished 4 Jun 2025

OSINT - New Russia-affiliated actor Void Blizzard targets critical sectors for espionage

Affects type osintSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

Impact

For European organizations, particularly those in critical infrastructure sectors such as energy, transportation, government, and telecommunications, the presence of a Russia-affiliated espionage actor like Void Blizzard poses significant risks. Successful intrusions could lead to unauthorized access to sensitive data, intellectual property theft, disruption of services, and erosion of trust in digital systems. Espionage activities may also enable further cyber operations, including sabotage or influence campaigns. Given Europe's geopolitical tensions with Russia, organizations may face increased targeting intensity. The impact on confidentiality is paramount, with potential cascading effects on national security and economic stability. Although the current severity is low, the evolving nature of such threat actors necessitates vigilance to prevent escalation and mitigate long-term consequences.

Defensive guidance

European organizations should implement targeted defenses beyond generic cybersecurity hygiene. These include: 1) Enhancing network segmentation and monitoring to detect unusual payload delivery and lateral movement indicative of espionage activity. 2) Deploying advanced threat detection tools with behavioral analytics to identify novel or stealthy intrusion attempts. 3) Conducting regular threat intelligence sharing with national CERTs and sector-specific Information Sharing and Analysis Centers (ISACs) to stay informed on Void Blizzard's evolving TTPs. 4) Implementing strict access controls and multi-factor authentication to limit attacker footholds. 5) Performing proactive threat hunting exercises focusing on indicators of compromise related to Russian-affiliated actors. 6) Ensuring incident response plans specifically address espionage scenarios and include coordination with law enforcement and intelligence agencies. 7) Prioritizing security awareness training to recognize social engineering tactics that may facilitate payload delivery. These measures, tailored to the espionage context, will improve resilience against Void Blizzard's operations.

Indicators of compromise

Domains 5

micsrosoftonline.comActor-controlled spear-phishing domain (Evilginx)
ebsumrnit.euActor-controlled spear-phishing domain (malicious sender)
outlook-office.micsrosoftonline.comActor controlled spear-phishing domain
micsrosoftonline.comResult from a rrset lookup on DNSDB about the hostname: outlook-office.micsrosoftonline.com
micsrosoftonline.comResult from a rrset lookup on DNSDB about the hostname: outlook-office.micsrosoftonline.com

Hashes 1

Malicious email attachment

06a5bd9cb3038e3eec1c68cb34fc3f64933dba2983e39a0b1125af8af32c8ddb

Counter 4

1
1
124Result from a rrset lookup on DNSDB about the hostname: outlook-office.micsrosoftonline.com
2Result from a rrset lookup on DNSDB about the hostname: outlook-office.micsrosoftonline.com

Text 16

https://www.circl.lu/pdns/
A
104.21.58.35
micsrosoftonline.com
https://www.circl.lu/pdns/
A
172.67.199.124Cloudflare (as usual)
micsrosoftonline.com
104.21.58.35Result from a rrset lookup on DNSDB about the hostname: outlook-office.micsrosoftonline.com
172.67.199.124Result from a rrset lookup on DNSDB about the hostname: outlook-office.micsrosoftonline.com

Datetime 8

2025-04-26T19:44:21+00:00
2025-04-26T19:44:21+00:00
2025-04-26T19:44:21+00:00
2025-04-26T19:44:21+00:00
2025-05-27T16:36:31+00:00Result from a rrset lookup on DNSDB about the hostname: outlook-office.micsrosoftonline.com
2025-06-03T12:54:10+00:00Result from a rrset lookup on DNSDB about the hostname: outlook-office.micsrosoftonline.com
2025-05-28T15:00:06+00:00Result from a rrset lookup on DNSDB about the hostname: outlook-office.micsrosoftonline.com
2025-05-30T17:03:20+00:00Result from a rrset lookup on DNSDB about the hostname: outlook-office.micsrosoftonline.com

Community reviews

Loading reviews…