Winter Vivern

MITRE ATT&CK: G1035 View on attack.mitre.org

Aliases: TA473, UAC-0114, TAG-70, TA-473, Winter Vivern

First seen
2020-01-01 00:00:00
Origin
RU
Primary motivation
espionage
Sophistication
intermediate
Resource level
government
Actor type
nation-state
Last IoC activity
2026-06-15 17:58:19
Profile updated
2026-07-07 11:49:01

Targeted industries: government-and-public-sector education-and-nonprofits

Targeted regions: country_code:eu country_code:in country_code:us

Context

Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control.

Detection coverage

  • 666 Sigma rules

Malware & tools used

  • Command and Scripting Interpreter (attack-pattern)
  • Web Protocols (attack-pattern)
  • Web Portal Capture (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Virtual Private Server (attack-pattern)
  • JavaScript (attack-pattern)
  • Spearphishing Attachment (attack-pattern)
  • Masquerade Task or Service (attack-pattern)
  • Screen Capture (attack-pattern)
  • Drive-by Compromise (attack-pattern)
  • Automated Collection (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Automated Exfiltration (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Exploit Public-Facing Application (attack-pattern)
  • Vulnerability Scanning (attack-pattern)
  • Exfiltration Over C2 Channel (attack-pattern)
  • Scheduled Task (attack-pattern)
  • Web Services (attack-pattern)
  • Masquerading (attack-pattern)
  • Domains (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Malicious Link (attack-pattern)
  • File and Directory Discovery (attack-pattern)

Reports & references

  • bsi.bund.de — Aktive Apt Gruppen Node (report)
  • sentinelone.com — Winter Vivern Uncovering A Wave Of Global Espionage (report)
  • domaintools.com — Winter Vivern A Look At Re Crafted Government Maldocs (report)
  • ESET — Winter Vivern Exploits Zero Day Vulnerability Roundcube Webmail Servers (report)
  • proofpoint.com — Exploitation Dish Best Served Cold Winter Vivern Uses Known Zimbra Vulnerability (report)
  • socprime.com — Uac 0114 Group Aka Winter Vivern Attack Detection Hackers Launch Malicious Phishing Campaigns Targeting Government Entities Of Ukraine And Poland (report)
  • cybersecuritynews.com — Russian Hackers Xss Flaw (report)
  • recordedfuture.com — Russia Aligned Tag 70 Targets European Government And Military Mail (report)
  • MITRE ATT&CK — G1035 (report)
  • CERT-UA — 3761104 (report)

External references