THREAT_ACTOR · G1035
Winter Vivern
Also known as: Winter Vivern, TA473, UAC-0114
Profile
Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control.
MITRE ATT&CK ↗Techniques
27 ATT&CK techniques attributed to this actor.
T1020 Automated ExfiltrationT1033 System Owner/User DiscoveryT1036 MasqueradingT1036.004 Masquerade Task or ServiceT1041 Exfiltration Over C2 ChannelT1053.005 Scheduled TaskT1056.003 Web Portal CaptureT1059 Command and Scripting InterpreterT1059.001 PowerShellT1059.003 Windows Command ShellT1059.007 JavaScriptT1071.001 Web ProtocolsT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1105 Ingress Tool TransferT1113 Screen CaptureT1114.001 Local Email CollectionT1119 Automated CollectionT1140 Deobfuscate/Decode Files or InformationT1189 Drive-by CompromiseT1190 Exploit Public-Facing ApplicationT1204.001 Malicious LinkT1566.001 Spearphishing AttachmentT1583.001 DomainsT1583.003 Virtual Private ServerT1584.006 Web ServicesT1595.002 Vulnerability Scanning
Related corpus activity
10,446 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Winter Vivern.
| Indicator | Type | Family | Sev | Src |
|---|---|---|---|---|
| cve-2023-44976 | cve | ransomware | 85 | 2 |
| cve-2026-1969 | cve | — | 85 | 1 |
| cve-2025-68670 | cve | — | 85 | 2 |
| cve-2026-3102 | cve | — | 85 | 3 |
| cve-2025-34117 | cve | — | 85 | 1 |
| cve-2021-29441 | cve | — | 85 | 1 |
| cve-2026-22584 | cve | — | 85 | 2 |
| cve-2025-11837 | cve | — | 85 | 2 |
| cve-2025-34054 | cve | — | 85 | 4 |
| cve-2014-2321 | cve | — | 85 | 1 |
| cve-2020-22653 | cve | — | 85 | 2 |
| cve-2025-2492 | cve | — | 85 | 2 |
| cve-2017-18377 | cve | — | 85 | 1 |
| cve-2021-25646 | cve | — | 85 | 1 |
| cve-2025-66478 | cve | — | 85 | 2 |
| cve-2025-0921 | cve | — | 85 | 2 |
| cve-2021-27076 | cve | — | 85 | 1 |
| cve-2013-3307 | cve | — | 85 | 2 |
| cve-2016-5681 | cve | — | 85 | 2 |
| cve-2016-15047 | cve | — | 85 | 4 |
| cve-2024-1781 | cve | — | 85 | 1 |
| cve-2018-8007 | cve | — | 85 | 1 |
| cve-2021-4045 | cve | — | 85 | 1 |
| cve-2020-17456 | cve | — | 85 | 1 |
| cve-2022-47945 | cve | — | 85 | 1 |
| cve-2020-22658 | cve | — | 85 | 2 |
| cve-2025-23304 | cve | — | 85 | 2 |
| cve-2026-4368 | cve | ransomware | 85 | 1 |
| cve-2013-7471 | cve | — | 85 | 1 |
| cve-2026-0740 | cve | — | 85 | 1 |
Showing the top 30 by severity of 10,446.