Loading story…
The Winter Vivern threat actor ran a spearphishing campaign against European government institutions using malicious Excel documents built with Excel 4.0 (XLM) macros. Researchers linked the activity to earlier reporting after finding overlapping infrastructure and tradecraft, with targets including organizations associated with the Vatican, Lithuania, and Slovakia. The lures were crafted around government-themed content and recast into multiple language contexts, indicating deliberate tailoring for official recipients.
The malicious spreadsheets used public decoy content while hidden macros launched PowerShell to retrieve follow-on payloads from attacker-controlled domains including securetourspd.com and secure-daddy.com. Investigators said the campaign evolved from earlier Winter Vivern activity by introducing victim-specific URL paths, clean XLS decoy downloads, and modified command-and-control URL structures, while preserving the group’s focus on government entities. The malware established persistence through a scheduled task named Server_Update_Synchronization-{SDFGEYH-9D36-4HB1-8BWD-0EC1BD4FNM131} and deployed a lightweight RAT that checked in with its command-and-control server every 10 seconds.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
Lab52 analyzed the July 2021 activity and attributed it to Winter Vivern based on overlaps with prior DomainTools reporting. The researchers said the newer campaign evolved from the earlier May 2021 activity with victim-specific URL paths, decoy clean XLS downloads, and modified C2 URL structures.
Lab52 discovered an active July 2021 spearphishing campaign using malicious Excel 4.0 macro documents attributed to Winter Vivern. The activity targeted European government institutions, including entities associated with the Vatican, Lithuania, and Slovakia.
Lab52 reported that the domain securetourspd.com, used in the later campaign infrastructure, was registered and resolved to 185.238.169.57. The IP was associated with IROKO Networks Corporation/Scalaxy B.V.
DomainTools published reporting on a Winter Vivern campaign using re-crafted government-themed malicious documents targeting multiple languages. Lab52 later cited this reporting as the earlier campaign to which it linked newer activity.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 26 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ukrainian organizations were targeted in a phishing campaign attributed to **UAC-0056**—also tracked as **SaintBear**, **UNC2589**, and **TA471**—that used macro-enabled Excel attachments themed around wage arrears to deliver a multi-stage malware chain. Reporting says the infection sequence involved **Elephant Dropper**, **Elephant Downloader**, **Elephant Implant**, and **Elephant Client**, which retrieved additional payloads from attacker-controlled infrastructure, established persistence, and deployed the **GraphSteel** and **GrimPlant** backdoors. Targets reportedly included Ukrainian entities such as **ICTV**, continuing a pattern of espionage activity against government and state-linked organizations. The campaign aligns with earlier UAC-0056 operations documented by CERT-UA and other researchers, including phishing emails impersonating Ukrainian government bodies and fake software or update packages such as `BitdefenderWindowsUpdatePackage.exe`. In those incidents, victims were directed to malicious infrastructure including `forkscenter[.]fr`, with follow-on payloads fetched from Discord and resulting in **Cobalt Strike Beacon**, **GraphSteel**, and **GrimPlant** infections. Across the observed activity, the malware collected host and network data and sought credentials and user information from browsers, Wi-Fi profiles, Windows Credential Manager and PasswordVault, mail accounts, **PuTTY**, and **FileZilla**.
Aug 15, 2026
Emotet operators resumed large-scale phishing activity by sending emails from compromised organizational mail servers and using spoofed display names, reply-style subject lines, and topical lures such as IRS tax notices. Multiple reports found the messages commonly carried password-protected ZIP archives containing malicious Excel files with legacy **Excel 4.0/XLM macros**. After a user enabled editing or macros, the spreadsheet downloaded an Emotet payload from compromised or attacker-controlled URLs and launched it with **`regsvr32.exe`**, restoring Emotet’s foothold after its earlier disruption. Researchers observed that infected hosts then contacted multiple Emotet command-and-control servers and could be repurposed as spambots to send additional phishing emails with malicious spreadsheet attachments, extending the campaign. Analysis across the reports identified packed DLL or OCX payloads, Windows service persistence, and follow-on risk including delivery of tools such as **Cobalt Strike** or **SystemBC**. The references also published hunting and detection material, including Microsoft 365 Defender KQL queries, file hashes, domains, IP addresses, and JA3/JA3S TLS fingerprints, while noting that the campaigns continued to succeed partly because some environments still allowed Office macros despite Microsoft hardening changes.
Aug 15, 2026
Threat actors are increasingly leveraging weaponized document formats and add-ins to compromise Windows users, with recent campaigns targeting organizations in multiple countries. One operation uncovered by researchers used phishing emails with RAR archives containing obfuscated JavaScript payloads, which exploited the CVE-2017-11882 vulnerability in Microsoft Office's Equation Editor. The infection chain included the use of malicious SVG files, ZIP archives with LNK shortcuts, and a sophisticated four-stage execution pipeline involving steganographically embedded .NET assemblies and the abuse of legitimate open-source libraries, all designed to evade detection and deliver commodity loaders for Remote Access Trojans and information stealers. Separately, attackers have been abusing Microsoft Excel's XLL add-in format to deliver malware, with a notable increase in such activity since 2021. Recent incidents include the submission of malicious XLL files to VirusTotal from Ukraine and Russia, which contained a backdoor named EchoGather capable of system reconnaissance, command execution, and file transfer. These XLL-based attacks often use open-source frameworks like Excel-DNA to facilitate payload delivery and in-memory execution, further complicating detection and mitigation efforts for targeted organizations.
Jun 29, 2026