Microsoft on Tuesday published technical documentation on a new Russia-linked espionage outfit it calls “Void Blizzard,” warning that the group has spent the past year quietly looting e-mail, files and even Teams chats from government and defense contractors across Europe and North America.
In a new report published in tandem with Dutch intelligence agencies, Redmond’s threat hunting team said the Kremlin hacking team is leaning heavily on the low-cost end of the cybercrime economy: buying stolen usernames and passwords from infostealer markets for use in password-spraying attacks.
In recent weeks, Microsoft said it watched the team adopt a more surgical “adversary-in-the-middle spear-phishing” tactic that spoofs the Microsoft Entra login page with a a typo-squatted domain and a malicious QR-code invitation to a fake European defense summit.
“We assess that Void Blizzard is using the open-source attack framework Evilginx to conduct the AitM phishing campaign and steal authentication data, including the input username and password and any cookies generated by the server,” Microsoft said. Evilginx, publicly released in 2017, is a widely available phishing kit with [adversary-in-the-middle) AitM capabilities.
While the techniques are textbook for government-level cyberespionage campaigns, the targeting is very specific with a victim list that overlaps with other Russia-linked cyberspies, Microsoft said, noting that the Russian hackers are likely pilfering wartime intelligence that can be fed back into military or diplomatic planning.
Microsoft said NATO states and Ukraine remain the prime hunting grounds and flagged a case where a Ukrainian aviation agency was hacked by separate Russian APTs, demonstrating focused targeting on air-traffic and aerospace networks.
According to Microsoft, the Void Blizzard playbook is straightforward: steal credentials, log in to Exchange or SharePoint Online, and automate the download of anything a compromised user can see.
Redmond said its threat intelligence center discovered “a cluster of worldwide cloud abuse activity” linked to Void Blizzard and warned that the threat actor’s prolific activity against networks in critical sectors poses a heightened risk to NATO member states and allies to Ukraine..
