What other aliases and vendor names is Void Blizzard known by?

Void Blizzard is tracked across the cybersecurity industry by multiple aliases, including: 85th Main Special Service Center, APT-C-20, APT28, ATG2, ATK5, Blue Athena, BlueDelta, CL-STA-1114.

What vulnerabilities and CVEs does Void Blizzard actively exploit?

Void Blizzard has been observed weaponizing vulnerabilities including CVE-2025-66376.

Void Blizzard

Q: What are the primary motivations and sponsors of Void Blizzard?

Void Blizzard operates from Russia with primary motivation categorized as Strategic espionage, political influence, and intelligence gathering related to geopolitical conflicts., sponsored or affiliated with Russian Federation (GRU).

ACTIVE CAMPAIGN TRACKED ⚠ Critical Threat Russia

Primary Aliases: APT28 FANCY BEAR Forest Blizzard LAUNDRY BEAR

Sponsor / State Affiliation Russian Federation (GRU)

Primary Motivation Strategic espionage, political influence, and intelligence gathering related to geopolitical conflicts.

Active Timeline Unknown – Present

Confidence Rating 95% (Grounded)

Microsoft 365 Credential and OAuth Exploitation, European Diplomatic Espionage, Ukraine Conflict Support Operations

⚔️ Weaponized CVE Matrix (1)

CVE-2025-66376

Weaponized Vulnerability

CVSS 8.5 KEV EPSS 85.0%

🎯 Target Sectors & Focus

Government agencies Military and Defense organizations NATO member states Diplomatic missions Ukrainian critical infrastructure Non-governmental organizations (NGOs) Telecommunications