Threat actors from the Russia-aligned Winter Vivern APT group have been conducting global cyberespionage campaigns against those who support and aid Ukraine. Winter Vivern, named after a command-and-control (C2) node URL string, was brought to light in early 2021 and has since been an underreported group. These actors attempt to stay out of the limelight as much as possible; however, this recent campaign has brought attention back to the group. Historically, the group has targeted numerous government organizations throughout India, Lithuania, Slovakia, and Vatican with espionage-related cyberattacks. Recent activity from Winter Vivern involved targeting the Ukraine & Italy Ministry of Foreign Affairs, Polish government agencies, and high-profile individuals throughout the Indian government. Tactics, techniques, and procedures (TTPs) of this campaign include Winter Vivern actors hosting clones of websites to disseminate their malicious payloads, hosting websites for credential phishing, and deploying masked Windows batch files to execute on a set schedule. One (1) malware variant observed during this campaign is “APERETIF”, which is often hosted on vulnerable WordPress websites for malware distribution. Indicators of compromise (IOCs) uncovered in this recent Winter Vivern campaign can be referenced from the reports below. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.