{
  "Event": {
    "analysis": "1",
    "date": "2026-06-09",
    "extends_uuid": "",
    "info": "[Threat Intel] Affidavit in Support of Application for Criminal Complaint",
    "protected": false,
    "publish_timestamp": "1782230692",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1782230692",
    "uuid": "48a8d13e-0e7e-4d6f-8807-d4d9761dc8b5",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#7773ac",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"",
        "relationship_type": ""
      },
      {
        "colour": "#77a4ec",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Collection - T1114\"",
        "relationship_type": ""
      },
      {
        "colour": "#ff841f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"",
        "relationship_type": ""
      },
      {
        "colour": "#d4fd6f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Impair Defenses - T1562\"",
        "relationship_type": ""
      },
      {
        "colour": "#bce57a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Web Service - T1567\"",
        "relationship_type": ""
      },
      {
        "colour": "#65d24c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Gather Victim Identity Information - T1589\"",
        "relationship_type": ""
      },
      {
        "colour": "#62e1b7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Browser Session Hijacking - T1185\"",
        "relationship_type": ""
      },
      {
        "colour": "#adf1b0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"",
        "relationship_type": ""
      },
      {
        "colour": "#cfba47",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Automated Exfiltration - T1020\"",
        "relationship_type": ""
      },
      {
        "colour": "#5bb38b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malware - T1588.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b24806",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Indicator Removal - T1070\"",
        "relationship_type": ""
      },
      {
        "colour": "#b206a3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Accounts - T1586\"",
        "relationship_type": ""
      },
      {
        "colour": "#2da3e8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Gather Victim Network Information - T1590\"",
        "relationship_type": ""
      },
      {
        "colour": "#00f752",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Alternative Protocol - T1048\"",
        "relationship_type": ""
      },
      {
        "colour": "#6fe7f4",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Tool - T1588.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b95cd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"",
        "relationship_type": ""
      },
      {
        "colour": "#59699c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#a0d02a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing for Information - T1598\"",
        "relationship_type": ""
      },
      {
        "colour": "#a42e64",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Information Repositories - T1213\"",
        "relationship_type": ""
      },
      {
        "colour": "#b8ab01",
        "local": false,
        "name": "misp-galaxy:target-information=\"United States\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"Void Blizzard\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#10003d",
        "local": false,
        "name": "rectifyq:sub-category=\"TA-profile\"",
        "relationship_type": ""
      },
      {
        "colour": "#150050",
        "local": false,
        "name": "rectifyq:sub-category=\"report\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#1c006d",
        "local": false,
        "name": "rectifyq:topic=\"geopolitical\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578822",
        "to_ids": false,
        "type": "link",
        "uuid": "8abf7d21-7bde-409f-ad49-7ae4ebec01a5",
        "value": "https://cyberscoop.com/wp-content/uploads/sites/3/2026/06/11-1.pdf",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578822",
        "to_ids": false,
        "type": "text",
        "uuid": "e46570f3-d29c-4f08-9fc2-7d72f8b7aca8",
        "value": "An FBI investigation identified Denis Nikolayevich Obrezko, a Russian national, as facilitating cyber intrusions conducted by the Russia-aligned threat group Void Blizzard. Between June and July 2024, multiple U.S. companies across various sectors were targeted in a large-scale cyber espionage campaign involving mass email harvesting and unauthorized access. The threat actors utilized stolen session tokens, proxy services, and VPNs to authenticate to victim Office 365 environments and exfiltrate data. Obrezko allegedly obtained critical infrastructure including a virtual private server and domain registration used in these attacks. FBI investigation linked Obrezko through cryptocurrency transactions, email accounts, phone numbers, and IP addresses to domains and infrastructure used in the intrusion campaign. Eleven U.S. companies have confirmed unauthorized access, representing only a fraction of suspected victims nationwide."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578822",
        "to_ids": false,
        "type": "text",
        "uuid": "02ea08d9-b5e8-4c54-84f0-fce74f847880",
        "value": "Name: Affidavit in Support of Application for Criminal Complaint\nAuthor: AlienVault\nAdversary: Void Blizzard\nTags: [\"void blizzard\", \"cryptocurrency\", \"denis obrezko\", \"proxy infrastructure\", \"cyber espionage\", \"russia-aligned\", \"session token theft\", \"office 365 compromise\"]\nTgtd countries: [\"United States of America\"]\nMlwr families: []\nAttack_ids: [\"T1133\", \"T1114\", \"T1071\", \"T1562\", \"T1567\", \"T1589\", \"T1185\", \"T1090\", \"T1020\", \"T1588.001\", \"T1070\", \"T1586\", \"T1590\", \"T1048\", \"T1588.002\", \"T1566\", \"T1078\", \"T1573\", \"T1598\", \"T1213\"]\nIndustries: [\"Education\", \"Finance\", \"Technology\", \"Government\", \"Healthcare\", \"Manufacturing\", \"Retail\", \"Energy\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578822",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "f596d093-a47e-4778-86f1-89a4d27927d7",
        "value": "Void Blizzard"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782101927",
        "to_ids": true,
        "type": "domain",
        "uuid": "47292dfa-9f74-4b49-90c6-3c0afffcf80c",
        "value": "lnstagram.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782101948",
        "to_ids": true,
        "type": "domain",
        "uuid": "4b59d497-6b6b-4c72-bd2b-61eecd08e134",
        "value": "ebsummlt.eu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782101969",
        "to_ids": true,
        "type": "domain",
        "uuid": "a769c468-e3f1-42f5-a710-984d86b85046",
        "value": "miscrsosoft.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782101990",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a404d5b1-a63f-4c64-8bf8-d1c60ce06512",
        "value": "172.86.75.235",
        "Tag": [
          {
            "colour": "#5beb6d",
            "local": false,
            "name": "asn:asn=\"399629\"",
            "relationship_type": ""
          },
          {
            "colour": "#6967e5",
            "local": false,
            "name": "asn:as-owner=\"BLNWX\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782102011",
        "to_ids": true,
        "type": "url",
        "uuid": "67e5a1e1-156c-4455-9a3d-1921ea1e12e7",
        "value": "http://lnstagram.com/wlsperrrrr/",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782102033",
        "to_ids": true,
        "type": "domain",
        "uuid": "720e34be-662a-46b9-9296-296cd5d64e0a",
        "value": "ffice365.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782102054",
        "to_ids": true,
        "type": "domain",
        "uuid": "993ddd07-68fa-48b8-9f05-d2d4ca5c17c1",
        "value": "micsroft.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}