Winter Vivern

Winter Vivern is an advanced persistent threat actor tracked under the aliases TA473 and UAC-0114. According to the provided content, SentinelLABS assessed that Winter Vivern’s activities are closely aligned with global objectives supporting the interests of the governments of Belarus and Russia. The actor has conducted initial access via malicious email attachments, including malicious document files using XLM 4.0 macros and base64-encoded exploit payloads in email messages. In some intrusion chains, execution passed from document macros to PowerShell, and the group also used Windows batch scripts disguised as virus scanners to trigger download of malicious payloads using built-in system tools. Winter Vivern has also delivered malicious JavaScript to exploit Roundcube Webmail servers. Post-compromise activity described in the content includes PowerShell-based victim information gathering, including execution of whoami to identify the current user, recursive scanning for various file types, and exfiltration of identified files via HTTP. For persistence, Winter Vivern executed PowerShell scripts that created scheduled task objects to periodically retrieve and execute remotely hosted payloads. The actor uses HTTP and HTTPS for command and control and exfiltration. The content also states that Winter Vivern used remotely hosted instances of the Acunetix vulnerability scanner and adversary-owned or adversary-controlled servers to host web vulnerability scanning applications.