IC Technology & Cyber — 2026-07-25

Russian Hackers Target US Nuclear Scientists and Defense Contractors in Year-Long Email Espionage Campaign

BLUFAllied attribution of "Laundry Bear" across more than a dozen governments signals that Russia's cyber-collection against Western nuclear and defense targets has reached a scale forcing coordinated defensive response.

A joint advisory from US and allied security agencies, released Thursday, warns of an ongoing Russian cyber-espionage campaign targeting nuclear scientists, defense contractors, and government employees over the past year 12. Security firm Proofpoint told CNN the hackers targeted email servers used by "nuclear installations and the defense industrial base," with an apparent focus on entities working on nuclear fusion research 12. The advisory said the group used a software exploit requiring only that a target open an email, capable of extracting up to three months of correspondence and an organization's full email directory, and reported the operators tested techniques against Ukrainian targets before deploying them against NATO members 123. Finland's Supo, working with the Finnish Defence Intelligence Agency and the US NSA, separately identified the actor as "Laundry Bear," saying it has used social engineering and stolen credentials against public administration, critical infrastructure, and defense-sector targets in NATO countries and Ukraine 4. Thai authorities arrested an alleged member of the group in November, extradited to the US, who made an initial court appearance in Boston last month 123.

Analysis
The joint publication by more than a dozen governments obligates targeted sectors to audit email logs against the exploit's signature, since the level of technical detail in the advisory indicates allied services hold collection on the group beyond what Proofpoint and other private researchers have disclosed. Identification of the same activity as "Laundry Bear" by Finnish and US services confirms a shared attribution across multiple national intelligence services rather than an isolated private-sector finding, widening the set of NATO organizations expected to conduct retrospective reviews. The focus on nuclear fusion research indicates Russia's collection priorities extend beyond battlefield-relevant intelligence into energy-technology competition. Continued silence from the Department of Energy, FBI, and NSA on specifics indicates the scope of any compromise remains under assessment.

4 sources