By 
A newly identified Russian cyber-espionage group, dubbed Laundry Bear, has been linked to the September 2024 security breach of the Dutch national police, according to a joint advisory from Dutch intelligence agencies.
The breach, first disclosed by the Dutch police (Politie) last year, resulted in the theft of work-related contact details belonging to multiple officers. The stolen information included names, email addresses, phone numbers, and in some instances, private personal data.
On Tuesday, the Dutch General Intelligence and Security Service (AIVD) and the Military Intelligence and Security Service (MIVD) attributed the attack to Laundry Bear, warning that the group might also have infiltrated other Dutch organizations.
The advisory states that the attackers gained access by compromising a police employee's account and extracting contact information via the Global Address List (GAL). Investigators believe the method used was a pass-the-cookie attack, where a stolen authentication cookie—likely acquired through infostealer malware sold on a criminal marketplace—was used to impersonate the account holder, bypassing the need for login credentials.
Laundry Bear, also known as Void Blizzard, has been tracked by Microsoft since at least April 2024. Their operations align with Russian strategic interests, frequently targeting Ukraine and NATO member countries.
Their tactics typically involve stolen credentials and spear-phishing campaigns to infiltrate targeted networks. Once inside, they focus on harvesting emails and files from compromised systems.
Void Blizzard’s espionage campaigns are aimed at organizations of interest to the Russian state.
Laundry Bear has previously compromised Ukrainian organizations in the defense and transportation sectors. In October 2024, they breached accounts at a Ukrainian aviation firm—an entity that had also been targeted in 2022 by APT44 (Seashell Blizzard), a group tied to Russia’s GRU military intelligence agency.
