Laundry Bear

Weekly cybersecurity update (525)

This episode delves into the weekly cybersecurity update from CERT SE for week 525. Link: https://www.cert.se/2025/06/cert-se-veckobrev-v25.html

Wartime Strategic Communication in Ukraine

This episode covers a new FOI report that offers an empirically grounded analysis of Ukrainian strategic communication during the 2023–2024 phase of the Russo-Ukrainian war, aiming to identify general lessons for wartime communication in democratic states. It examines the evolution of Ukraine's communication efforts, from initial formalisation to adapting under chaotic invasion conditions. It highlights challenges like war fatigue, information vacuums, and the struggle to maintain global attention. The report also explores Russian information manipulation tactics (dismiss, distort, distract, dismay, divide) and Ukraine's use of offensive communication, ultimately concluding that effective strategic communication is a critical tool but not a standalone solution to war, requiring agility, transparency, and a nuanced understanding of diverse audiences and evolving information environments. Link: https://www.foi.se/rapportsammanfattning?reportNo=FOI-R--5758--SE

Laundry Bear

This episode details a joint report from Dutch intelligence services, the AIVD and MIVD, that reveals the identification of a new, likely Russian state-supported cyber threat actor named LAUNDRY BEAR, also tracked by Microsoft as Void Blizzard. This group has been targeting Western government organizations and defense-related entities since 2024 through relatively simple, yet effective, methods including exploiting valid accounts and password spraying to access email and retrieve sensitive data, demonstrating a high success rate in espionage activities. The report also provides technical details on LAUNDRY BEAR's tactics and offers a range of mitigation strategies to enhance organizational resilience against these threats.

Meta First Quarter Adversarial Threat Report

This episode details the findings of an investigation into coordinated inauthentic behavior (CIB) networks by Meta. Their First Quarter (-25) Adversarial Threat Report focused on operations originating in China, Iran, and Romania, which used fake accounts across multiple online platforms. Each network targeted specific regions with content designed to manipulate public discourse, often reposting news and current events. The report outlines the tactics and threat indicators associated with these operations, including the acquisition of accounts and strategies for disguising their identities and engaging with audiences. Ultimately, these networks were disrupted before they could establish a significant presence.

Weekly cybersecurity update (522)

This episode delves into the landscape of hybrid threats as seen in the CERT-SE report for week 22, 2025, highlighting how cyber operations are now a central tool in this complex domain where peace and conflict blur. The report provides a snapshot of national and international cyber incidents and trends. Several key themes emerged, including persistent state-sponsored activity, the vulnerability of critical national infrastructure, the evolving tactics of cybercriminals, and ongoing efforts to bolster cyber defenses.