Winter Vivern
Also known as UAC-0114, TA473, TAG-70, TA-473
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
Winter Vivern is a cyberespionage group first revealed by DomainTools in 2021. It is thought to have been active since at least 2020 and it targets governments in Europe and Central Asia. To compromise its targets, the group uses malicious documents, phishing websites, and a custom PowerShell backdoor.
Targets: Germany
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1020 Automated ExfiltrationT1033 System Owner/User DiscoveryT1036 MasqueradingT1036.004 Masquerade Task or ServiceT1041 Exfiltration Over C2 ChannelT1053.005 Scheduled TaskT1056.003 Web Portal CaptureT1059 Command and Scripting InterpreterT1059.001 PowerShellT1059.003 Windows Command ShellT1059.007 JavaScriptT1071.001 Web ProtocolsT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1105 Ingress Tool TransferT1113 Screen CaptureT1114.001 Local Email CollectionT1119 Automated CollectionT1140 Deobfuscate/Decode Files or InformationT1189 Drive-by CompromiseT1190 Exploit Public-Facing ApplicationT1204.001 Malicious LinkT1566.001 Spearphishing AttachmentT1583.001 DomainsT1583.003 Virtual Private ServerT1584.006 Web ServicesT1595.002 Vulnerability Scanning
Recent activity
No posts or advisories have named this actor recently.
References
- https://www.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espionage/
- https://www.domaintools.com/resources/blog/winter-vivern-a-look-at-re-crafted-government-maldocs
- https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/
- https://www.proofpoint.com/us/blog/threat-insight/exploitation-dish-best-served-cold-winter-vivern-uses-known-zimbra-vulnerability
- https://socprime.com/blog/uac-0114-group-aka-winter-vivern-attack-detection-hackers-launch-malicious-phishing-campaigns-targeting-government-entities-of-ukraine-and-poland/
- https://cybersecuritynews.com/russian-hackers-xss-flaw/
- https://www.recordedfuture.com/russia-aligned-tag-70-targets-european-government-and-military-mail
- https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html
- https://attack.mitre.org/groups/G1035
- https://cert.gov.ua/article/3761104
- https://www.domaintools.com/resources/blog/winter-vivern-a-look-at-re-crafted-government-maldocs/
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.