Security Resilience

Threat actor · all actors

Void BlizzardMISP-b495419f state

🇷🇺 RU

aka Void Blizzard, LAUNDRY BEAR, UAC-0190, TA488

Last updated: 2026-10-16

1attributed CVEs
0ATT&CK techniques
3.2IDF score (tooling uniqueness)
0exclusive CVEs
2026years active

About this actor

Void Blizzard’s cyberespionage operations tend to be highly targeted at specific organizations of interest to the Russian government, including in government, defense, transportation, media, non-governmental organizations (NGOs), and healthcare sectors primarily in Europe and North America. The threat actor uses stolen credentials—which are likely procured from commodity infostealer ecosystems—and collects a high volume of email and files from compromised organizations.

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

Microsoftweather-system names

Void Blizzard

CrowdStrikenation-animal names

LAUNDRY BEAR

CERT-UAUAC cluster id

UAC-0190

ProofpointTA threat-actor id

TA488

How we know this

Data origin
MISP threat-actor galaxy Imported from the open-source MISP threat-actor galaxy.
Techniques
No ATT&CK techniques mapped.
Named victims
None on file.

Thin data: No ATT&CK techniques are mapped yet — the behavioural profile is empty.

See how actor data is built for the full pipeline.

Activity timeline

2026: 1 CVE published2026: 1 KEV added22026
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2025-66376 KEV8.07.20.28822026-01-05see CVE

No techniques attributed.

Co-occurring actors

Similar actors

Overlapping CVEs

Active in same years

Same nation-state

Same category