MITRE ATT&CK: T1583.001 - Acquire Infrastructure: Domains | T1566.001 - Phishing: Spearphishing Attachment | T1059.001: PowerShell | T1059.003 - Command and Scripting Interpreter: Windows Command Shell | T1105 - Ingress Tool Transfer It is important to teach your users basic online hygiene and phishing awareness. Many advanced attacks start with basic techniques such as unwarranted email with malicious attachments that requires the user to open it and enable macroses. Anomali customers concerned about risks to their digital assets (including similar/typosquatted domains) can try out Anomali's Premium Digital Risk Protection service. The group’s malicious infrastructure includes typosquatted domains and compromised WordPress websites.Īnalyst Comment: Pay attention if a domain is asking for your passwords, try to establish its authenticity and ownership. Another type of Winter Vivern activity include malicious Office documents with macros, loader script mimicking a virus scanner, and the installation of the Aperetif backdoor. The group often relies on simply phishing for credentials.

In early 2023, Winter Vivern created fake pages for Poland’s Central Bureau for Combating Cybercrime, the Ukraine Ministry of Foreign Affairs, and the Security Service of Ukraine. During mid 2022 to December 2022, it targeted India and Ukraine: impersonated the Indian government’s email service website and sent macro-enabled Excel to target a project facilitating surrender of Russian military personnel. Since January 2021, it targeted government organizations in Lithuania, India, Vatican, and Slovakia. Since December 2020, Winter Vivern was engaging in cyberespionage campaigns aligned with Belarus and Russian government objectives. Trending Cyber News and Threat Intelligence Winter Vivern | Uncovering a Wave of Global Espionage

Remove eset