Winter Vivern

Winter Vivern is a Russia-aligned cyber-espionage threat actor tracked under aliases including TA473 and UAC-0114. The group is known for targeting government, diplomatic, military, and other high-value organizations, particularly across Europe and Asia, with a strong emphasis on webmail-centric intrusion activity. Winter Vivern has repeatedly focused on stealing emails, credentials, and related account data from internet-facing mail platforms, especially Zimbra and Roundcube deployments. The actor is associated with phishing for credentials and exploitation of public-facing webmail applications. Reported activity includes exploitation of Zimbra vulnerabilities such as CVE-2022-27926 and reflected or stored cross-site scripting flaws to compromise webmail portals and steal mailbox contents from NATO-aligned organizations, government officials, military personnel, and diplomats. Winter Vivern has also been linked to targeting Roundcube in campaigns aimed at high-value email communications. In some operations, the group delivered malicious JavaScript payloads that interacted directly with compromised mail interfaces to enumerate folders and emails and facilitate theft of message data. Observed tradecraft and ATT&CK mappings associated with Winter Vivern include exploitation of public-facing applications, credential phishing, PowerShell and other command-and-scripting interpreter use, DNS-based command and control, masquerading, automated collection, and post-compromise discovery. The group has been associated with credential theft and email collection objectives rather than disruptive or financially motivated operations. Winter Vivern is widely characterized as a state-sponsored espionage actor aligned with Russian interests.