[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3rLwBIFe-bPFcAe8xKut_1VGtkROECcfcLD6jW_qPFo":3},{"article":4,"iocs":41,"watch_terms":48,"solutions":49,"lesson":131},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"7c3a995b-9da1-4c89-9ad6-09fdcc270b3b","Russian national charged in connection with Void Blizzard espionage campaign","russian-national-charged-in-connection-with-void-blizzard-espionage-campaign-6bfe6b","Denis Obrezko accused of orchestrating cyberattacks that compromised at least 11 U.S. companies as part of the Kremlin-linked group's sprawling espionage operation.\\ The post Russian national charged in connection with Void Blizzard espionage campaign appeared first on CyberScoop.","A Russian national, Denis Obrezko, has been charged by U.S. federal prosecutors in connection with the Void Blizzard cyber-espionage campaign. Obrezko is accused of facilitating attacks against at least 11 U.S. companies by purchasing virtual private servers and domain names used by the Kremlin-linked group. Void Blizzard, also known as Laundry Bear, has been observed using stolen session tokens and proxy services for large-scale espionage operations.","Russian national Denis Obrezko charged in connection with Void Blizzard espionage campaign targeting US companies.","https:\u002F\u002Fcyberscoop.com\u002Frussian-national-charged-void-blizzard-cyber-espionage\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F06\u002FGettyImages-629101330.jpg","2026-06-11T17:11:12+00:00","2026-06-11T18:00:27.931612+00:00",8,[17,20,22,25],{"name":18,"type":19},"Void Blizzard","threat_actor",{"name":21,"type":19},"Laundry Bear",{"name":23,"type":24},"Microsoft","vendor",{"name":26,"type":27},"Microsoft Entra ID","product","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":28,"icon":30,"name":31,"slug":32},null,"Nation-state","nation-state",[34,36],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42,46],{"type":43,"value":44,"context":45},"domain","miscrsosoft[.]com","Typosquatted domain used in Void Blizzard spear-phishing campaign.",{"type":43,"value":47,"context":45},"micsrosoftonline[.]com",[23,26],{"controls":50,"vendors":127},[51,78,101],{"slug":52,"name":53,"problem":54,"products":55},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[56,64,70],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":65,"vendor_name":23,"vendor_logo":66,"product_slug":67,"product_name":26,"url":68,"description":69},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":79,"name":80,"problem":81,"products":82},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[83,88,96],{"vendor_slug":65,"vendor_name":23,"vendor_logo":66,"product_slug":84,"product_name":85,"url":86,"description":87},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":97,"product_name":98,"url":99,"description":100},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":102,"name":103,"problem":104,"products":105},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[106,114,122],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":65,"vendor_name":23,"vendor_logo":66,"product_slug":123,"product_name":124,"url":125,"description":126},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",[128],{"slug":65,"name":23,"logo_path":66,"roles":129},[130],"reported_by",{"slug":132,"title":133,"body":134,"framework_refs":135,"framework_notes":141},"state-sponsored-group-exploits-stolen-session-tokens-for-enterprise-espionage","State-Sponsored Group Exploits Stolen Session Tokens for Enterprise Espionage","The Void Blizzard campaign demonstrates how sophisticated threat actors exploit weak session management and inadequate monitoring to conduct large-scale espionage. The attackers used stolen session tokens to bypass traditional authentication controls, allowing them to maintain persistent access to victim networks. This highlights the critical importance of implementing robust session security controls and comprehensive monitoring systems that can detect anomalous authentication patterns and unauthorized access attempts.",[136,137,138,139,140],"CIS Control 6 (Access Control Management)","CIS Control 8 (Audit Log Management)","NIST AC-2 (Account Management)","NIST AC-12 (Session Termination)","NIST SI-4 (System Monitoring)",{}]