Russia-linked LAUNDRY BEAR exposed in phishing campaign
UK NCSC and international partners attribute a zero-click phishing campaign against Western organisations to a newly named Russian state-supported group, LAUNDRY BEAR.
Sourcencsc.gov.uk — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
The UK's National Cyber Security Centre (NCSC), part of GCHQ, together with international partners, has publicly attributed a targeted phishing campaign to a Russian state-supported threat group tracked as LAUNDRY BEAR. The advisory describes the activity as 'zero-click' phishing, targeting Western organisations, though the published notice provided does not disclose specific victim sectors, malware samples, or technical indicators of compromise.
The disclosure functions primarily as a public attribution and warning rather than a detailed technical advisory. Defenders in government, defense, and allied Western institutions should treat this as confirmation of ongoing Russian state-sponsored targeting via phishing techniques and should review authentication and session-security controls, as 'zero-click' phishing campaigns often rely on token theft or session hijacking rather than requiring user interaction with malicious payloads. Organisations are advised to monitor for further technical guidance from NCSC and partner agencies as it becomes available, and to reinforce email security, conditional access policies, and monitoring for anomalous authentication events consistent with credential or session-token compromise.
Mentioned in this report
Detection guidance
Suspicious Phishing-Associated Network Beaconing to Rare Destinations
A behavioural hunt for the technique in general.
Detects outbound network connections to rare or newly observed destination IPs/domains shortly after phishing campaign detection, consistent with C2 or data exfiltration tied to token theft. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Phishing-Associated Network Beaconing to Rare Destinations
description: Detects outbound network connections to newly observed or geographically
anomalous destinations following suspected phishing exposure, consistent with C2
beaconing or token/data exfiltration. Complements phishing indicators by detecting
the post-compromise communication channel often used to exploit stolen authentication
tokens.
tags:
- attack.command-and-control
- attack.t1566
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationPort:
- 443
- 8443
- 80
- 8080
DestinationIp|cidr:
- 185.0.0.0/8
- 195.0.0.0/8
- 203.0.0.0/8
User|contains: '@'
filter_known_good:
DestinationHostname|contains:
- microsoft.com
- google.com
- cloudflare.com
- amazon.com
filter_corporate_vpn:
DestinationPort: 1194
condition: selection and not (filter_known_good or filter_corporate_vpn)
falsepositives:
- Legitimate cloud storage or SaaS access from Eastern European providers
- Misconfigured corporate proxy routing through unexpected egress IP ranges
level: medium
id: bd1b3863-3878-5d3d-bb61-5e44a8df0bda
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ncsc.gov.uk/news/uk-and-partners-expose-russian-state-supported-actors-for-new-zero-click-phishing-campaign
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the actors it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs