Affidavit in Support of Application for Criminal Complaint
Essential information
- Published
- 11/06/2026 23:09
- Modified
- 15/06/2026 19:16
- Source / Author
- AlienVault
- Confidence
- 100/100
- Report type(s)
- threat-report
- Labels / Tags
- cryptocurrency cyber espionage denis obrezko office 365 compromise proxy infrastructure russia-aligned session token theft void blizzard
- Tags
- 2026-06-11 cryptocurrency cyber espionage denis obrezko office 365 compromise proxy infrastructure russia-aligned session token theft void blizzard
- Related entities
- 7 indicators, 7 observables, 1 intrusion sets (apt), 20 techniques (mitre), 14 others
Description
An FBI investigation identified Denis Nikolayevich Obrezko, a Russian national, as facilitating cyber intrusions conducted by the Russia-aligned threat group Void Blizzard. Between June and July 2024, multiple U.S. companies across various sectors were targeted in a large-scale cyber espionage campaign involving mass email harvesting and unauthorized access. The threat actors utilized stolen session tokens, proxy services, and VPNs to authenticate to victim Office 365 environments and exfiltrate data. Obrezko allegedly obtained critical infrastructure including a virtual private server and domain registration used in these attacks. FBI investigation linked Obrezko through cryptocurrency transactions, email accounts, phone numbers, and IP addresses to domains and infrastructure used in the intrusion campaign. Eleven U.S. companies have confirmed unauthorized access, representing only a fraction of suspected victims nationwide.