Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control.12345
- DomainTools WinterVivern 2021
- SentinelOne WinterVivern 2023
- CERT-UA WinterVivern 2023
- ESET WinterVivern 2023
- Proofpoint WinterVivern 2023
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1059 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.007 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.004 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1113 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1189 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1119 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1020 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1595.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.006 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1020 | Automated Exfiltration | — |
| T1033 | System Owner/User Discovery | — |
| T1036 | Masquerading | — |
| T1036.004 | Masquerade Task or Service | — |
| T1041 | Exfiltration Over C2 Channel | — |
| T1053.005 | Scheduled Task | — |
| T1056.003 | Web Portal Capture | — |
| T1059 | Command and Scripting Interpreter | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.007 | JavaScript | — |
| T1071.001 | Web Protocols | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1105 | Ingress Tool Transfer | — |
| T1113 | Screen Capture | — |
| T1114.001 | Local Email Collection | — |
| T1119 | Automated Collection | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1189 | Drive-by Compromise | — |
| T1190 | Exploit Public-Facing Application | — |
| T1204.001 | Malicious Link | — |
| T1566.001 | Spearphishing Attachment | — |
| T1583.001 | Domains | — |
| T1583.003 | Virtual Private Server | — |
| T1584.006 | Web Services | — |
| T1595.002 | Vulnerability Scanning | — |
Aliases
TA473 · UAC-0114 · Winter Vivern
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.