Laundry Bear Infrastructure: Key Tactics and Procedures Uncovered

Laundry Bear also tracked as Void Blizzard by Microsoft Threat Intelligence has emerged as one of the most sophisticated Russian state-sponsored advanced persistent threats (APTs) in recent years, actively targeting NATO member countries, Ukraine, and key institutions across Europe and the US since at least April 2024.

First publicly detailed in reports by Dutch intelligence and Microsoft, the actor demonstrates a rapidly evolving infrastructure and a highly adaptive approach to cyber-espionage, with a range of techniques to facilitate credential theft, spear phishing, and persistent intelligence gathering.

Technical Analysis

Initial analysis centered around a limited set of reported indicators: micsrosoftonline[.]com and related subdomains employed in spear phishing operations, and ebsumrnit[.]eu as a malicious sender domain.

Both domains are typified by strategic typosquatting, closely imitating legitimate organizations to lure victims. Notably, the malicious sender domain ebsumrnit[.]eu was observed as a lookalike for ebsummit[.]eu, the domain of the European Business Summits.

Such domains were registered via PDR Solutions, often using privacy-centric, difficult-to-trace email providers like onionmail[.]org, and were configured with mail delivery services such as Mailgun and Cloudflare-protected infrastructure to obfuscate their origins.

According to the report, Using platforms like Validin for advanced pivoting, researchers employed DNS, registration, and host response history to unfold a broader web of related domains and subdomains.

Regular expression searches for lookalike domains within the .eu TLD and registration date filtering quickly revealed a cluster of six additional domains all exhibiting similar registration characteristics, service configurations, and timeline proximity, marking them as likely assets of Laundry Bear’s infrastructure.

Expanded analysis demonstrated that several lookalike domains served benign redirects sometimes to legitimate business summits, at others to Cloudflare phishing warnings.

The temporal sequence of redirection and subsequent suspension or blacklisting hints at reactive countermeasures following increased scrutiny after public reporting.

Pivoting Across Technical Artifacts

Further, investigation into the spear-phishing infrastructure (exemplified by micsrosoftonline[.]com) uncovered additional domains through host response body fingerprinting.

For instance, phishing sites are periodically repurposed or sinkholed, often redirecting visitors to unrelated content such as when micsrosoftonline[.]com returned a Rick Astley music video redirection, presumably as a disruption tactic.

Operating at scale, the threat actor used redirect-based phishing lures imitating Microsoft, Okta, and other enterprise login portals.

Host response body hash matches facilitated the identification of a network of domains, including ones like maidservant[.]shop and it-sharepoint[.]com, which also featured dozens of credential harvesting subdomains across AWS, DigitalOcean, and other global infrastructure providers.

Reverse DNS mapping exhibited significant overlap in IP addresses and certificate reuse, strengthening correlations among observed artifacts.

On certain occasions, infrastructure such as walshhgroup[.]com mimicked real organizations and leveraged subdomains not just for phishing but for possible malware or document delivery demonstrated by non-standard HTTPS port PDF delivery.

SMTP services facilitated email-based delivery vectors, confirming Laundry Bear’s capability for flexible multi-vector attacks.

This campaign highlights the adversary’s rapid domain churn, use of privacy shields, commercial cloud infrastructure, traffic redirection, and wide-ranging abuse of legitimate-looking login pages as primary operational techniques.

Discovery of these elements depended on granular DNS and HTTP response history, registration artifact correlation, and sophisticated lookalike patterning.

Threat hunters are advised to focus not only on static IOCs but also on pivots using response behaviors and infrastructure overlaps to proactively detect and mitigate related threats.

Key Indicators of Compromise (IOCs)

Indicator Type	IOC Value
Apex Domains (E2LDs)	redronesolutions.cloud, ourbelovedsainscore.space, weblogmail.live, microffice.org, spidergov.org, portal-microsoftonline.com, micsrosoftonline.com, enticator-secure.com, remerelli.com, myspringbank.com, propescom.com, defraudatubanco.com, m-365-app.com, max-linear.com, app-v4-mybos.com, miscrsosoft.com, it-sharepoint.com, deloittesharepoint.com, mail-forgot.com, x9a7lm02kqaccountprotectionaccountsecuritynoreply.com, maidservant.shop, teamsupportonline.top, aoc-gov.us, bidscale.net, refundes.net, avsgroup.au, ebsum.eu, ebsumlts.eu, ebsurnmit.eu, ebsumrnit.eu, ebsummlt.eu, ebsummt.eu
Common Subdomains	login, email, account, okta, live, csp, sso, reporting, microsoftonline, mail, cdn
Related IP Addresses	3.64.201.107, 3.126.53.226, 5.230.36.62, 34.204.123.157, 54.144.139.77, 64.23.244.176, 64.226.126.33, 52.78.180.48, 54.167.184.45, 104.168.144.21, 154.216.18.83, 170.64.163.105, 170.64.209.129, 176.97.124.54

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates

The post Laundry Bear Infrastructure: Key Tactics and Procedures Uncovered appeared first on Cyber Security News.