Winter Vivern

Overview

Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control.

Regions

Germany

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1190

TTPs — 27 techniques across 9 tactics

Reporting (3)

• Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers — Matthieu Faou
• Exploitation is a Dish Best Served Cold: Winter Vivern Uses Known Zimbra Vulnerability to Target Webmail Portals of NATO-Aligned Governments in Europe — Michael Raggi & The Proofpoint Threat Research Team
• Winter Vivern | Uncovering a Wave of Global Espionage — Tom Hegel