A Russian-aligned Advanced Persistent Threat (APT) known as Winter Vivern has been observed conducting espionage operations targeting government and civilian communications organizations.
Security researchers at SentinelOne shared details about the new campaign in an advisory published Thursday. APT activity was first identified by DomainTools in early 2021 and then further detailed by Lab 52 months later.
Threat researcher Tom Hegel wrote in an advisory for SentinelOne: “Part of the Winter Vivern campaign was reported by his CBZC in Poland in recent weeks, and then by CERT in Ukraine he was reported as UAC-0114.”
According to Hegel, Winter Vivern’s activities are consistent with the global objectives and interests of the Belarusian and Russian governments.
“Recently linked campaigns reveal that Winter Vivern targeted individuals within Polish government agencies, the Ukrainian Ministry of Foreign Affairs, the Italian Ministry of Foreign Affairs, and the Indian government,” the advisory reads. increase. “Of particular interest is the APT’s targeting of private companies, including telecommunications organizations, that support Ukraine in the ongoing war.”
Read more about Ukraine here: Cyber Threat Landscape Shaped by Ukraine Conflict, ENISA Report Reveals
Hegel further explained that Winter Vivern used tactics tailored to the target organization to increase the success rate of decoys through phishing and malicious document deployment.
“Winter Vivern’s tactics include the use of malicious documents, often crafted from genuine government documents that are publicly available or tailored to specific themes.” Malware Researcher writes. “Recently, the group has utilized new lure techniques to mimic government domains to distribute malicious downloads.”
The SentinelOne team considers APTs to be a “formidable force” in the cyber domain due to their ability to lure targets into attack.
“Their ability to lure targets into attack and their targeting of governments and high-value private companies shows the level of sophistication and strategic intent in their operations,” wrote Hegel.
SentinelOne’s advisory comes days after security experts noted that Russia’s cyber tactics in Ukraine had been observed to focus on espionage.
