# Russia-linked LAUNDRY BEAR exposed in phishing campaign

Published: 2026-07-23 · Severity: elevated · Sectors: government-national, defense
Canonical: https://vorant.io/reports/fa60ddf8-e6ce-50c8-bf84-fff2f9be9ba6/russia-linked-laundry-bear-exposed-in-phishing-campaign

> UK NCSC and international partners attribute a zero-click phishing campaign against Western organisations to a newly named Russian state-supported group, LAUNDRY BEAR.

The UK's National Cyber Security Centre (NCSC), part of GCHQ, together with international partners, has publicly attributed a targeted phishing campaign to a Russian state-supported threat group tracked as LAUNDRY BEAR. The advisory describes the activity as 'zero-click' phishing, targeting Western organisations, though the published notice provided does not disclose specific victim sectors, malware samples, or technical indicators of compromise.

The disclosure functions primarily as a public attribution and warning rather than a detailed technical advisory. Defenders in government, defense, and allied Western institutions should treat this as confirmation of ongoing Russian state-sponsored targeting via phishing techniques and should review authentication and session-security controls, as 'zero-click' phishing campaigns often rely on token theft or session hijacking rather than requiring user interaction with malicious payloads. Organisations are advised to monitor for further technical guidance from NCSC and partner agencies as it becomes available, and to reinforce email security, conditional access policies, and monitoring for anomalous authentication events consistent with credential or session-token compromise.

## Mentioned in this report

- Threat actors: TA488

## Detection guidance (public sample)

### Anomalous Authentication Following Phishing Indicators

ATT&CK: T1528

Detects authentication events with characteristics consistent with stolen or hijacked session tokens: logins from unusual geographies, impossible travel times, or new device fingerprints shortly after phishing campaign indicators. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Anomalous Authentication Following Phishing Indicators
description: Detects authentication events consistent with stolen application access
  tokens or session hijacking - logins from unexpected locations, impossible travel
  times, or new devices shortly after potential phishing exposure. Zero-click phishing
  campaigns often bypass user interaction but result in token theft; this rule correlates
  suspicious auth patterns that indicate session compromise rather than credential
  entry.
tags:
- attack.credential-access
- attack.t1528
logsource:
  category: authentication
  product: windows
detection:
  selection_impossible_travel:
    EventID: 4624
    LogonType:
    - 3
    - 10
    IpAddress|startswith:
    - 192.168.
    - '10.'
    - '172.'
    PreviousIpAddress|startswith:
    - '185.'
    - '195.'
    - '203.'
  selection_new_device:
    EventID: 4624
    LogonType:
    - 3
    - 10
    DeviceName: null
  filter_vpn:
    IpAddress|contains:
    - vpn
    - proxy
  filter_service_accounts:
    TargetUserName|endswith:
    - $
    - _svc
  condition: (selection_impossible_travel or selection_new_device) and not (filter_vpn
    or filter_service_accounts)
falsepositives:
- Legitimate remote workers or travelling employees authenticating from different
  geographies
- Organisational VPN or proxy infrastructure masking true source IP
level: medium
id: 65a22819-7762-5742-952f-c126c43ba215
status: experimental
author: Vorant
```

### Suspicious Phishing-Associated Network Beaconing to Rare Destinations

ATT&CK: T1566

Detects outbound network connections to rare or newly observed destination IPs/domains shortly after phishing campaign detection, consistent with C2 or data exfiltration tied to token theft. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Phishing-Associated Network Beaconing to Rare Destinations
description: Detects outbound network connections to newly observed or geographically
  anomalous destinations following suspected phishing exposure, consistent with C2
  beaconing or token/data exfiltration. Complements phishing indicators by detecting
  the post-compromise communication channel often used to exploit stolen authentication
  tokens.
tags:
- attack.command-and-control
- attack.t1566
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort:
    - 443
    - 8443
    - 80
    - 8080
    DestinationIp|cidr:
    - 185.0.0.0/8
    - 195.0.0.0/8
    - 203.0.0.0/8
    User|contains: '@'
  filter_known_good:
    DestinationHostname|contains:
    - microsoft.com
    - google.com
    - cloudflare.com
    - amazon.com
  filter_corporate_vpn:
    DestinationPort: 1194
  condition: selection and not (filter_known_good or filter_corporate_vpn)
falsepositives:
- Legitimate cloud storage or SaaS access from Eastern European providers
- Misconfigured corporate proxy routing through unexpected egress IP ranges
level: medium
id: bd1b3863-3878-5d3d-bb61-5e44a8df0bda
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ncsc.gov.uk/news/uk-and-partners-expose-russian-state-supported-actors-for-new-zero-click-phishing-campaign

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/fa60ddf8-e6ce-50c8-bf84-fff2f9be9ba6/russia-linked-laundry-bear-exposed-in-phishing-campaign.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup