Threat Intelligence / Actor / Multiple (Winter Vivern/TAG-70, APT28/Fancy Bear)

Multiple (Winter Vivern/TAG-70, APT28/Fancy Bear)

Nation: Russia · 1 tracked threat(s) · Categories: VULNERABILITY

Also known as: Winter Vivern, TAG-70, APT28, Fancy Bear, Sofacy, Sednit

Tracked threats

RoundCube Webmail Active Exploitation — CVE-2025-49113 Deserialization RCE (CVSS 9.9) + CVE-2025-68461 XSS via SVG Animate Tag (CISA KEV) — CRITICAL

Full actor intelligence — infrastructure, IOCs, detection coverage and operator fingerprints — is available via the Threadlinqs MCP server (Purple tier). View plans →

Threadlinqs Intelligence