US Accuses Russian Cybersecurity Specialist D.O. of Void Blizzard Attacks on European Governments and US Companies, Kaspersky Ties Emerge
American authorities have formally accused Russian information security specialist D.O. of involvement in a series of cyberattacks attributed to the hacking group Void Blizzard, also known as Laundry Bear. The charges, presented in a Boston court, allege that the group has been stealing emails and other communications from government organizations in European countries cooperating with NATO, as well as from at least eleven American companies, beginning in 2023.
D.O. did not enter a guilty plea during the court proceedings. According to information drawn from social media profiles and publicly available resumes, he graduated from the Bauman Moscow State Technical University with a specialization in information security. European journalists have previously described the university as one of the institutions that may train personnel later involved in operations conducted by state structures, although the university itself has not commented on these claims.
The accused previously held a senior position at one of Russia’s largest cybersecurity companies, widely understood to be Kaspersky. The exact nature of his role within the company has not been disclosed. His employment there ended several years before the start of the hacking campaign described by prosecutors. In 2024 the US Department of Commerce prohibited the sale and use of the company’s software in the United States, citing national security threats. European authorities had earlier issued similar risk warnings.
The indictment also connects D.O. to a second IT company based in Nizhny Novgorod, where he served as deputy director starting in 2024. Although the indictment itself does not mention his earlier work at the major cybersecurity firm, this information surfaced later through salary documents and confirmation from a former colleague. The defense attorney declined to discuss the defendant’s employment history.
Specialists observe that transitions between commercial cybersecurity companies and state intelligence structures occur in various countries. Nevertheless, until the court delivers a final ruling, D.O.’s alleged participation in the Void Blizzard operations remains unproven.
Related articles
Three Hacker Castes: How Script-Kiddies, Codemasters and Grandmasters Operate and Why Advanced Attacks Evade Detection
JET CSIRT analyst Maxim Kishmereshkin breaks down real-world incidents showing that attackers fall into three distinct castes based on their tooling and sophistication. Script-kiddies rely on off-the-shelf utilities and are often stopped by basic antivirus, while codemasters modify existing tools to bypass signatures and leverage living-off-the-land binaries. Grandmasters develop custom fileless loaders and signed malware, as demonstrated in a recent Cavalry Werewolf campaign that used a trojanized 7-Zip binary and Adaptix C2 framework. The investigation revealed how attackers revived a decommissioned domain controller, used stolen credentials of former employees, and exfiltrated sensitive data entirely from memory. The report emphasizes that modern attacks mimic legitimate processes such as PowerShell commands or accounting software, making signature-based detection ineffective. Defense requires layered controls including EDR, behavioral rules, vulnerability management, and regular hardening to counter each caste level.
Russian-Aligned Gorbag Group Exploits WinRAR CVE-2025-8088 to Steal Credentials from Ukrainian Government Bodies
ESET has published a detailed report on the Gorbag threat group, a Russia-aligned actor active since at least February 2025, that has adopted the WinRAR path traversal vulnerability CVE-2025-8088 to deliver the BeautyStealer password stealer against Ukrainian public sector targets. The flaw, fixed in WinRAR 7.13, allows attackers to escape the chosen extraction folder and write files to arbitrary locations using Windows alternate data streams. Upon opening the malicious RAR archive, victims see a decoy PDF while a Windows startup shortcut and PowerShell loader are silently installed to maintain persistence. BeautyStealer, written in C++, harvests saved passwords, cookies, and browsing data from Chrome, Edge, Opera, and Firefox, along with OpenVPN configurations, KeePass databases, Java key files, and Ukrainian electronic signature keys. The group previously relied on malicious Excel macros in 2025 before switching to RAR-based delivery that requires no user interaction beyond opening the archive. Stolen data is exfiltrated via the Telegram API or, from version 1.2 onward, to attacker-controlled servers. ESET links the operation to earlier activity tracked as GIFTEDCROOK and UAC-0226 by CERT-UA.
Positive Technologies Analyzes 140 Incidents: Web Applications Drive Half of Breaches, APT Groups Found in 49% of Cases
Positive Technologies' Incident Response team examined more than 140 full-cycle investigations and retrospective analyses conducted between Q4 2025 and Q3 2026. Web applications on the perimeter remained the leading initial access vector, accounting for 50.8% of incidents, with newly targeted services including Zimbra mail servers and TrueConf video-conferencing platforms. APT activity was detected in 49.3% of victim organizations, while supply-chain attacks through contractors and ViPNet networks still represented 14.9% of entries despite a decline from the previous year. Industry became the most affected sector at 22.5%, and median time to bring incidents under control after engagement stood at two days. Root causes continued to center on outdated software, missing multi-factor authentication, and poor network segmentation. Three previously unknown APT groups—APT10051, Stingy Basilisk, and Chewbacca—were identified during the investigations.
Peskov Rejects Claims of Russian Involvement in European Refrigeration System Attacks
Kremlin spokesman Dmitry Peskov has dismissed accusations that Russian-linked cyber groups were behind recent attacks on industrial refrigeration equipment across nine European countries. The incidents, which occurred in early November, involved unauthorized changes to temperature settings on internet-connected cooling systems, with some units pushed to +50 °C. Similar attacks had already been reported in France during October, affecting meat producers and other facilities that rely on precise climate control. Peskov described the allegations as lacking any evidence and part of a recurring pattern of unsubstantiated claims directed at Russia by European nations. The targeted systems are typically connected online for remote maintenance and fault alerts, a feature that becomes a liability when external actors gain access. No group has claimed responsibility for the October or November operations, leaving attribution unconfirmed. The events highlight risks associated with exposing industrial control equipment directly to the internet without adequate segmentation or authentication controls.