Dutch intelligence exposed a previously unknown Russian hacking group 'Laundry Bear' responsible for cyber espionage attacks on Dutch organizations including the national police in 2024.

Cyber & Information WarfareCyber AttacksData theft / leaks

Aggressor

Summary

Dutch intelligence agencies AIVD and MIVD unmasked 'Laundry Bear,' a likely Russian state-sponsored hacking group conducting high-speed, automated, non-destructive espionage attacks targeting NATO countries' defense ministries, military units, aerospace and technology firms, and civilian entities focused on IT and technology sectors. The group exploited cloud email environments using simple, stealthy techniques avoiding malware, impersonated organizers in phishing campaigns, and targeted information relevant to Russian interests in Ukraine. Microsoft tracks the group as 'Void Blizzard,' noting its global activity since 2024 with a focus on NATO members and Ukraine. The hacking group was uncovered following a September 2024 session hijacking attack on a Dutch police employee account leading to theft of police contact details. The advisory warns that Laundry Bear's operations demonstrate knowledge about military equipment production and Western sanctions evasion. Dutch services emphasize incomplete insight into the group's activities and seek broader defensive measures.

Classification

Confidence: High

The signal describes deliberate, state-sponsored cyber operations affiliated with Russia targeting sensitive defense, governmental, and civilian sectors principally for espionage with known ties to Russian military intelligence tactics, constituting hostile hybrid warfare activity.

Source URL

https://therecord.media/laundry-bear-void-blizzard-russia-hackers-netherlands

Open source

Provenance

Publisher: extension
Submitted: Jul 31, 2026, 19:25 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Sep 1, 2024, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "84a24124-ad18-4405-a821-d2387eb7b113",
  "url": "https://therecord.media/laundry-bear-void-blizzard-russia-hackers-netherlands",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Data theft / leaks",
  "country": "Netherlands",
  "source_reliability": "B",
  "info_credibility": "2",
  "tags": [
    "Laundry Bear",
    "Void Blizzard",
    "Russian State-Sponsored",
    "offensive cyber operations",
    "Dutch Police Breach",
    "APT28 Modus Operandi",
    "Phishing",
    "Cloud Email Compromise",
    "NATO Defense Targets",
    "russia–ukraine war"
  ],
  "nodes": [],
  "countries": [
    "Netherlands"
  ],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "Dutch intelligence agencies AIVD and MIVD unmasked 'Laundry Bear,' a likely Russian state-sponsored hacking group conducting high-speed, automated, non-destructive espionage attacks targeting NATO countries' defense ministries, military units, aerospace and technology firms, and civilian entities focused on IT and technology sectors. The group exploited cloud email environments using simple, stealthy techniques avoiding malware, impersonated organizers in phishing campaigns, and targeted information relevant to Russian interests in Ukraine. Microsoft tracks the group as 'Void Blizzard,' noting its global activity since 2024 with a focus on NATO members and Ukraine. The hacking group was uncovered following a September 2024 session hijacking attack on a Dutch police employee account leading to theft of police contact details. The advisory warns that Laundry Bear's operations demonstrate knowledge about military equipment production and Western sanctions evasion. Dutch services emphasize incomplete insight into the group's activities and seek broader defensive measures.",
  "summary_short": "Dutch intelligence exposed a previously unknown Russian hacking group 'Laundry Bear' responsible for cyber espionage attacks on Dutch organizations including the national police in 2024.",
  "summary_extended": null,
  "actor_primary": "Laundry Bear",
  "target_primary": null,
  "location_text": "The Netherlands",
  "location_region": null,
  "location_coordinates_lat": 52.1326,
  "location_coordinates_lon": 5.2913,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The signal describes deliberate, state-sponsored cyber operations affiliated with Russia targeting sensitive defense, governmental, and civilian sectors principally for espionage with known ties to Russian military intelligence tactics, constituting hostile hybrid warfare activity.",
  "event_time_utc": "2024-09-01T00:00:00.000Z",
  "end_time_utc": "2024-12-31T23:59:59.000Z",
  "event_time_confidence": "pm24h",
  "created_at": "2026-07-31T19:25:00.099Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "within_24h",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighIndependence confirmedTime: Same dayLocation: Regional

Source reliability

Info credibility

Event time

Sep 1, 2024, 00:00 UTC

End time

Dec 31, 2024, 23:59 UTC

Event time confidence

pm24h

Location

The Netherlands

Primary actor

Laundry Bear

Country

Netherlands

Countries

Netherlands

Tags

Laundry Bear, Void Blizzard, Russian State-Sponsored, offensive cyber operations, Dutch Police Breach, APT28 Modus Operandi, Phishing, Cloud Email Compromise, NATO Defense Targets, russia–ukraine war

Loading signal...

{ "id": "84a24124-ad18-4405-a821-d2387eb7b113", "url": "https://therecord.media/laundry-bear-void-blizzard-russia-hackers-netherlands", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Data theft / leaks", "country": "Netherlands", "source_reliability": "B", "info_credibility": "2", "tags": [ "Laundry Bear", "Void Blizzard", "Russian State-Sponsored", "offensive cyber operations", "Dutch Police Breach", "APT28 Modus Operandi", "Phishing", "Cloud Email Compromise", "NATO Defense Targets", "russia–ukraine war" ], "nodes": [], "countries": [ "Netherlands" ], "where_text": "Cyberspace", "headline": null, "description": "Dutch intelligence agencies AIVD and MIVD unmasked 'Laundry Bear,' a likely Russian state-sponsored hacking group conducting high-speed, automated, non-destructive espionage attacks targeting NATO countries' defense ministries, military units, aerospace and technology firms, and civilian entities focused on IT and technology sectors. The group exploited cloud email environments using simple, stealthy techniques avoiding malware, impersonated organizers in phishing campaigns, and targeted information relevant to Russian interests in Ukraine. Microsoft tracks the group as 'Void Blizzard,' noting its global activity since 2024 with a focus on NATO members and Ukraine. The hacking group was uncovered following a September 2024 session hijacking attack on a Dutch police employee account leading to theft of police contact details. The advisory warns that Laundry Bear's operations demonstrate knowledge about military equipment production and Western sanctions evasion. Dutch services emphasize incomplete insight into the group's activities and seek broader defensive measures.", "summary_short": "Dutch intelligence exposed a previously unknown Russian hacking group 'Laundry Bear' responsible for cyber espionage attacks on Dutch organizations including the national police in 2024.", "summary_extended": null, "actor_primary": "Laundry Bear", "target_primary": null, "location_text": "The Netherlands", "location_region": null, "location_coordinates_lat": 52.1326, "location_coordinates_lon": 5.2913, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The signal describes deliberate, state-sponsored cyber operations affiliated with Russia targeting sensitive defense, governmental, and civilian sectors principally for espionage with known ties to Russian military intelligence tactics, constituting hostile hybrid warfare activity.", "event_time_utc": "2024-09-01T00:00:00.000Z", "end_time_utc": "2024-12-31T23:59:59.000Z", "event_time_confidence": "pm24h", "created_at": "2026-07-31T19:25:00.099Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "within_24h", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "independent_sources" }