CVE Intelligence
Home / Threat actors / Winter Vivern

Winter Vivern G1035

🔔 Create alert

Also known as: TA473, UAC-0114

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0
associated CVEs
30
Techniques
0
Malware and tools

Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Reconnaissance
T1595.002 Vulnerability Scanning
Resource Development
T1583.001 DomainsT1583.003 Virtual Private ServerT1584.006 Web Services
Initial Access
T1189 Drive-by CompromiseT1190 Exploit Public-Facing ApplicationT1566.001 Spearphishing Attachment
Execution
T1053.005 Scheduled TaskT1059 Command and Scripting InterpreterT1059.001 PowerShellT1059.003 Windows Command ShellT1059.007 JavaScriptT1204.001 Malicious Link
Persistence
T1053.005 Scheduled Task
Privilege Escalation
T1053.005 Scheduled Task
Stealth
T1036 MasqueradingT1036.004 Masquerade Task or ServiceT1140 Deobfuscate/Decode Files or Information
Credential Access
T1056.003 Web Portal Capture
Discovery
T1033 System Owner/User DiscoveryT1082 System Information DiscoveryT1083 File and Directory Discovery
Collection
T1056.003 Web Portal CaptureT1113 Screen CaptureT1114.001 Local Email CollectionT1119 Automated Collection
Command and Control
T1071.001 Web ProtocolsT1105 Ingress Tool Transfer
Exfiltration
T1020 Automated ExfiltrationT1041 Exfiltration Over C2 Channel

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.