MITRE ATT&CKgroup

G1035 Winter Vivern

Published 2024-07-29 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
TA473, UAC-0114
Version
1.0
Created
2024-07-29

Description

Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control.

Related

Uses · MITRE ATT&CK (27)

  • T1595.002 Vulnerability Scanning sub-technique
  • T1583.003 Virtual Private Server sub-technique
  • T1584.006 Web Services sub-technique
  • T1583.001 Domains sub-technique
  • T1059.007 JavaScript sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1204.001 Malicious Link sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1114.001 Local Email Collection sub-technique
  • T1056.003 Web Portal Capture sub-technique
  • T1036.004 Masquerade Task or Service sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1189 Drive-by Compromise technique
  • T1190 Exploit Public-Facing Application technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1020 Automated Exfiltration technique
  • T1033 System Owner/User Discovery technique
  • T1036 Masquerading technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1059 Command and Scripting Interpreter technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1105 Ingress Tool Transfer technique
  • T1113 Screen Capture technique
  • T1119 Automated Collection technique

References