Threat actor · G1035

Winter Vivern

TA473UAC-0114

UnattributedNo public state or group attribution on record

Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control.

MITRE ATT&CK Techniques

T1020 T1033 T1036 T1036.004 T1041 T1053.005 T1056.003 T1059 T1059.001 T1059.003 T1059.007 T1071.001 T1082 T1083 T1105 T1113 T1114.001 T1119 T1140 T1189 T1190 T1204.001 T1566.001 T1583.001 T1583.003 T1584.006 T1595.002

Associated Malware

Full MITRE ATT&CK profile

0 recent articles mention this actor

No recent coverage in the current feed. This actor may be quiet, or reporting hasn't used a matched alias.