Ta473

TA473, also known as Winter Vivern and UAC-0114, is a Russian advanced persistent threat (APT) group that has been active since at least February 2023. The group focuses on cyber espionage, supporting Russian and Belarusian geopolitical objectives, especially in the context of the Russia-Ukraine conflict. TA473 has targeted NATO countries, US elected officials, and staffers, compromising emails through the exploitation of vulnerabilities in unpatched Zimbra endpoints and Roundcube webmail software. The group's activities have been tracked by cybersecurity researchers at Proofpoint, who have observed TA473 exploiting Zimbra vulnerability CVE-2022-27926 to abuse publicly facing Zimbra hosted webmail portals. In October 2023, TA473 was observed exploiting a zero-day flaw in Roundcube webmail software, specifically targeting RoundCube webmail request tokens. This led to a series of attacks across Europe, particularly in Ukraine, Poland, and Georgia. At least 80 critical infrastructure, government, and military organizations were targeted, spanning sectors from transport and education to chemical and biological research organizations. The exploitation involved sophisticated social engineering techniques and unique JavaScript payloads for the targeted webmail portal. By February 2024, the scale of TA473's operations had expanded significantly, with dozens of European organizations being targeted through the exploitation of cross-site scripting vulnerabilities impacting Roundcube email servers. According to reports from SecurityWeek and SC Magazine, these attacks affected critical infrastructure, government, and military organizations across Europe. Despite the wide range of targets, TA473's cyber operations continue to align primarily with the support of Russian and/or Belarussian geopolitical goals.