Winter Vivern
Also known asTA473 · UAC-0114
Summary
Espionage group first reported by DomainTools in 2021 and active since at least late 2020. It is tracked as TA473 by Proofpoint, UAC-0114 by CERT-UA and G1035 by MITRE; Recorded Future's TAG-70 overlaps with it. It targets European and Central Asian governments, with sporadic targeting of India, the Vatican and US elected officials and staff. Victims have included government bodies in Lithuania, Slovakia, Poland, Ukraine and Italy, Indian government users, and telecommunications firms supporting Ukraine. Early operations used government-themed maldocs with XLM macros and PowerShell (T1566.001) and look-alike government domains (T1583.001). The group also used fake antivirus scanners delivering the APERETIF trojan (T1036.004), compromised WordPress sites for staging (T1584.006) and government webmail credential pages (T1056.003). From 2023 it shifted to exploiting webmail (T1190, T1059.007): Zimbra CVE-2022-27926 against NATO-aligned European governments (Proofpoint), and Roundcube CVE-2020-35730 in Aug–Sep 2023. In Oct 2023 it used the Roundcube zero-day CVE-2023-5631 against European government entities and a think tank, with JavaScript that lists folders and exfiltrates mail (T1114.001; ESET). It has also opportunistically used Follina (CVE-2022-30190) and Acunetix scanning (T1595.002). Its targeting is assessed as aligned with Belarusian and Russian interests (SentinelOne, Proofpoint; Recorded Future: "likely operating on behalf of Belarus and Russia"). No government has attributed it, so it is recorded as unattributed.
Attribution
Aligned with Belarusian and Russian interests
Tracked by researchers; no state or organisation has been publicly attributed.
- MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Linked to Russian and Belarusian interests - SentinelOne SentinelLABS (Research, 2023-03-16)
Aligned with the interests of the Belarusian and Russian governments
Campaigns 5
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Roundcube XSS campaign against 80+ organisations in Georgia, Poland and Ukraine (as TAG-70)ASSESSED | 2023-10 – 2023-12 | Georgia, Poland, Ukraine | Government, Military | Recorded Future Insikt Group (2024-02) — TAG-70, which overlaps with Winter Vivern |
| Roundcube CVE-2020-35730 and CVE-2023-5631 zero-day exploitation against European government entities and a think tank | 2023-08 – 2023-10 | Europe | Government, Think Tanks | ESET (2023-10-25) |
| Zimbra CVE-2022-27926 exploitation against NATO-aligned European government webmail | 2023-02 – 2023-03 | Europe, USA | Government, Military, Diplomatic, Political | Proofpoint (2023-03-30) |
| Fake-antivirus and government-impersonation phishing against Polish, Ukrainian, Italian and Indian targets (APERETIF) | 2022 – 2023-03 | Poland, Ukraine, Italy, India | Government, Diplomatic, Telecommunications | SentinelOne (2023-03-16) |
| Government-themed XLM-macro maldocs against Lithuania, India and the Vatican | 2020-12 – 2021 | Lithuania, India, Vatican, Slovakia | Government, Religious | DomainTools (2021-04-27); SentinelOne (2023-03-16) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 10
| Reconnaissance1 | T1595.002Vulnerability Scanning |
|---|---|
| Resource Development2 | T1583.001DomainsT1584.006Web Services |
| Initial Access2 | T1566.001Spearphishing AttachmentT1190Exploit Public-Facing Application |
| Execution1 | T1059.007JavaScript |
| Persistence1 | T1053.005Scheduled Task |
| Stealth1 | T1036.004Masquerade Task or Service |
| Credential Access1 | T1056.003Web Portal Capture |
| Collection1 | T1114.001Local Email Collection |
Malware and tools 1
| Name | Description | Platform |
|---|---|---|
| APERETIF | Trojan (fake virus-scanner lure; CERT-UA name) | Windows |
Exploited vulnerabilities 4
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2022-30190 | 7.8 | Microsoft Windows Support Diagnostic Tool (MSDT) — remote code execution ("Follina") (KEV 2022-06-14) |
| CVE-2020-35730 | 6.1 | Roundcube Webmail — cross-site scripting (KEV 2023-06-22) |
| CVE-2022-27926 | 6.1 | Zimbra Collaboration — reflected cross-site scripting (KEV 2023-04-03) |
| CVE-2023-5631 | 6.1 | Roundcube Webmail — stored cross-site scripting, 0-day (KEV 2023-10-26) |
Highest CVSS first.
Infrastructure patterns
- Lookalike pages for government bodies and webmail on its own domains, e.g. ocspdep[.]com (SentinelOne, 2023)
- Compromised WordPress sites host its payloads (SentinelOne, 2023)
- Actor-controlled server running Acunetix to scan target webmail portals (SentinelOne, 2023; Proofpoint, 2023)
Reporting and advisories 5
- SentinelOne
Winter Vivern | Uncovering a Wave of Global Espionage (Mar 2023) - Proofpoint
Winter Vivern Uses Known Zimbra Vulnerability to Target Webmail Portals of NATO-Aligned Governments in Europe (Mar 2023) - ESET
Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers (Oct 2023) - DomainTools
Winter Vivern: A Look At Re-Crafted Government MalDocs (Apr 2021) - Recorded Future
Russia-Aligned TAG-70 Targets European Government and Military Mail Servers (Feb 2024)