Overview

• Dutch General Intelligence Agency and Military Agency linked Laundry Bear to September 2024 hacks of Dutch police and NATO networks.
• Investigators found the group spied on companies producing high-end technologies restricted by Western sanctions.
• Agencies assess the hackers are likely backed by the Russian state and sought intelligence on Western military procurement and arms deliveries to Ukraine.
• Recorded tactics included using stolen credentials, spear-phishing emails and pass-the-cookie attacks to exfiltrate sensitive data.
• Microsoft tracks the crew as Void Blizzard and warns it remains active against Western governments and critical sectors in Europe and North America.