A previously unidentified Russian government-backed hacking group, Void Blizzard (Laundry Bear), successfully breached a Ukrainian aviation organization in October. The attack was part of a broader cyberespionage campaign targeting NATO member states, Ukraine, and critical infrastructure sectors (defense, transportation, healthcare, and government). The hackers exploited stolen credentials and legitimate cloud APIs to exfiltrate sensitive data, including emails and potentially classified information related to military logistics, supply chains, and weapons procurement for Ukraine. The group employed living-off-the-land techniques, blending into normal system activity to avoid detection while accessing mailboxes, Teams messages, and shared folders. Given the organization’s role in aviation—a sector vital for military and humanitarian operations—the breach risks compromising operational security, flight logistics, or intelligence shared with Western allies. While the exact data stolen remains undisclosed, the attack aligns with Russia’s strategic goal of disrupting Ukraine’s defense capabilities and supply networks. The use of spear-phishing and credential theft suggests a prolonged, targeted intrusion with potential long-term reconnaissance implications for Ukraine’s aviation and broader defense infrastructure.