← Back to Actors
Winter Vivern
Winter VivernTA473UAC-0114
Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control.(Citation: DomainTools WinterVivern 2021)(Citation: SentinelOne WinterVivern 2023)(Citation: CERT-UA WinterVivern 2023)(Citation: ESET WinterVivern 2023)(Citation: Proofpoint Wint...
27
Techniques
24
Covered
3
Gaps
89%
Coverage
Coverage24/27
COVERED (24)
T1020Automated Exfiltration20 det.T1033System Owner/User Discovery62 det.T1036Masquerading616 det.T1036.004Masquerade Task or Service7 det.T1041Exfiltration Over C2 Channel32 det.T1053.005Scheduled Task100 det.T1059Command and Scripting Interpreter532 det.T1059.001PowerShell376 det.T1059.003Windows Command Shell87 det.T1059.007JavaScript64 det.T1071.001Web Protocols81 det.T1082System Information Discovery88 det.T1083File and Directory Discovery48 det.T1105Ingress Tool Transfer191 det.T1113Screen Capture19 det.T1114.001Local Email Collection11 det.T1119Automated Collection12 det.T1140Deobfuscate/Decode Files or Information58 det.T1189Drive-by Compromise12 det.T1190Exploit Public-Facing Application233 det.T1204.001Malicious Link11 det.T1566.001Spearphishing Attachment1055 det.T1583.001Domains68 det.T1595.002Vulnerability Scanning13 det.