Winter Vivern

Winter Vivern is a cyberespionage threat actor tracked under aliases including TA473 and UAC-0114. The group is widely assessed as a pro-Russian, likely state-aligned actor whose operations support the interests of Russia and Belarus. Since at least 2021, it has conducted espionage-focused campaigns primarily against government, diplomatic, military, and other high-value organizations, with targeting observed across Europe and beyond, including entities linked to Ukraine and NATO-aligned interests. Reported victims have included ministries of foreign affairs, government agencies, diplomats, military personnel, and at least one telecommunications organization supporting Ukraine. Winter Vivern is notable for achieving intelligence collection objectives with comparatively simple but adaptable tradecraft. The actor has repeatedly targeted webmail and collaboration platforms, including Zimbra and Roundcube, and has exploited cross-site scripting and related webmail vulnerabilities to steal emails, credentials, session data, contacts, and other mailbox contents. In one documented pattern, the group used malicious JavaScript payloads delivered through exploited webmail interfaces to enumerate folders and messages and exfiltrate data from victim accounts. The actor has also been associated with reflected XSS exploitation against Zimbra webmail portals to compromise accounts belonging to government and diplomatic targets. Beyond server-side and webmail exploitation, Winter Vivern has relied heavily on spearphishing, credential phishing, and malicious documents for initial access. Its lures have impersonated government themes and trusted institutions, and it has used phishing pages designed to mimic official services. Document-based infection chains have included XLM 4.0 macros and macro-enabled spreadsheets that pass execution to PowerShell. The group has also distributed Windows batch scripts disguised as benign utilities such as virus scanners in order to trigger follow-on payload retrieval using built-in system tools. Observed tooling includes the APERETIF trojan as well as lightweight script-based loaders and post-compromise collection components. Winter Vivern commonly uses PowerShell and batch scripting during execution and installation, including Invoke-Expression-based download-and-execute behavior. Its scripts perform basic host profiling, including execution of whoami and related victim information gathering, then transmit collected data to command-and-control infrastructure. The actor has also used Base64-encoded payloads and obfuscated script content as part of staging and execution. Collection activity is focused on espionage-relevant data. Winter Vivern has deployed PowerShell scripts that recursively scan victim systems for files of interest and exfiltrate identified content over HTTP or HTTPS. The group has also used malicious JavaScript in webmail compromises to harvest mailbox data directly from targeted accounts. Command and control and exfiltration have been observed over standard web protocols, helping the actor blend into normal network traffic. Winter Vivern has shown opportunistic infrastructure use, including compromised websites for malware hosting, while maintaining a relatively restrained and selective targeting profile compared with larger Russian intelligence-linked groups. Its operations consistently align with intelligence collection rather than disruptive or financially motivated objectives. Overall, Winter Vivern is best characterized as a resource-constrained but effective espionage actor specializing in phishing, webmail exploitation, script-based intrusion chains, and theft of communications data from government and geopolitical targets.