Winter Vivern

Overview

Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control.

Naming & attribution

Winter Vivern is tracked under 3 names across the industry. It uses 27 documented ATT&CK techniques — more than 61% of the 174 groups tracked here. Activity attributed since at least 2020.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1056.003 Web Portal Capture — used by 2 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Sidewinder India — 11 shared techniques (24% overlap)
• Confucius — 9 shared techniques (24% overlap)
• WIRTE — 10 shared techniques (23% overlap)
• ZIRCONIUM China — 10 shared techniques (22% overlap)
• Gamaredon Group Russia — 17 shared techniques (21% overlap)
• CURIUM Iran — 8 shared techniques (21% overlap)

Regions

Germany

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1190

TTPs — 27 techniques across 9 tactics

Reporting (3)

• Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers — Matthieu Faou
• Exploitation is a Dish Best Served Cold: Winter Vivern Uses Known Zimbra Vulnerability to Target Webmail Portals of NATO-Aligned Governments in Europe — Michael Raggi & The Proofpoint Threat Research Team
• Winter Vivern | Uncovering a Wave of Global Espionage — Tom Hegel