Threat Actor 🇷🇺 Russia

Winter Vivern

Also known as: UAC-0114 · TA473 · TAG-70 · TA-473

Winter Vivern is a cyberespionage group first revealed by DomainTools in 2021. It is thought to have been active since at least 2020 and it targets governments in Europe and Central Asia. To compromise its targets, the group uses malicious documents, phishing websites, and a custom PowerShell backdoor.

MITRE ATT&CK TTPs 1

T1059.001

PowerShell

Execution

Source Articles

Zimbra urges customers to patch critical web client XSS flaw

Zimbra has urged customers to patch a critical stored cross-site scripting (XSS) vulnerability in its Classic Web Client, which could allow attackers to execute malicious code via specially crafted emails. The flaw affects Zimbra Collaboration Suite users and could lead to theft of session data, account settings, or mailbox contents. Although no CVE has been assigned yet, the vulnerability was reported by Google's Threat Analysis Group and is suspected to be exploited by state-backed actors, particularly Russian-linked groups.

bleeping-computer ·2w ago