Threat actor · all actors
Winter VivernG1035 state
🇷🇺 RU
aka Winter Vivern, TA473, UAC-0114, TAG-70, TA-473
Last updated: 2026-08-20
About this actor
Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control.(Citation: DomainTools WinterVivern 2021)(Citation: SentinelOne WinterVivern 2023)(Citation: CERT-UA WinterVivern 2023)(Citation: ESET WinterVivern 2023)(Citation: Proofpoint WinterVivern 2023)
Source: MITRE ATT&CK
Names & naming systems
Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.
MITRE ATT&CKG-number catalogue id
CERT-UAUAC cluster id
ProofpointTA threat-actor id
Recorded FutureTAG id
Unclassifiedno scheme matched
How we know this
- Data origin
- MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
- Techniques
- MITRE ATT&CK STIX mappings — 36 ATT&CK techniques on file.
- Named victims
- None on file.
See how actor data is built for the full pipeline.
Activity timeline
- 2021 — 1 CVE published
Profile
| CVE | Risk | CVSS | EPSS | Published | Products |
|---|---|---|---|---|---|
CVE-2021-35207 | 5.1 | 6.1 | 0.0330 | 2021-07-02 | see CVE |
T1020Automated Exfiltration ↗T1033System Owner/User Discovery ↗T1036Masquerading ↗T1036.004Masquerade Task or Service ↗T1041Exfiltration Over C2 Channel ↗T1053Scheduled Task/Job ↗T1053.005Scheduled Task ↗T1056Input Capture ↗T1056.003Web Portal Capture ↗T1059Command and Scripting Interpreter ↗T1059.001PowerShell ↗T1059.003Windows Command Shell ↗T1059.007JavaScript ↗T1071Application Layer Protocol ↗T1071.001Web Protocols ↗T1082System Information Discovery ↗T1083File and Directory Discovery ↗T1105Ingress Tool Transfer ↗T1113Screen Capture ↗T1114Email Collection ↗T1114.001Local Email Collection ↗T1119Automated Collection ↗T1140Deobfuscate/Decode Files or Information ↗T1189Drive-by Compromise ↗T1190Exploit Public-Facing Application ↗T1204User Execution ↗T1204.001Malicious Link ↗T1566Phishing ↗T1566.001Spearphishing Attachment ↗T1583Acquire Infrastructure ↗T1583.001Domains ↗T1583.003Virtual Private Server ↗T1584Compromise Infrastructure ↗T1584.006Web Services ↗T1595Active Scanning ↗T1595.002Vulnerability Scanning ↗
Mitigating controls (NIST 800-53)
| Control | Techniques covered | Coverage |
|---|---|---|
SI-4 | 20 / 36 | 56% |
CM-6 | 19 / 36 | 53% |
CM-2 | 17 / 36 | 47% |
SI-3 | 15 / 36 | 42% |
CA-7 | 13 / 36 | 36% |
AC-4 | 12 / 36 | 33% |
AC-3 | 11 / 36 | 31% |
AC-6 | 11 / 36 | 31% |
CM-7 | 11 / 36 | 31% |
SC-7 | 11 / 36 | 31% |
SI-7 | 11 / 36 | 31% |
AC-2 | 10 / 36 | 28% |
CM-8 | 8 / 36 | 22% |
SI-2 | 8 / 36 | 22% |
AC-17 | 7 / 36 | 19% |
Co-occurring actors
None.
Similar actors
Similar TTPs
- Frankenstein 0.34
- Confucius 0.31
- SharePoint ToolShell Exploitation 0.29
- WIRTE 0.28
- Sidewinder 0.26
Active in same years
- C0018 1.00
- SolarWinds Compromise 1.00
- SharePoint ToolShell Exploitation 1.00
- APT1 1.00
- Deep Panda 1.00
Same nation-state
Same category
- Night Dragon 1.00
- FunnyDream 1.00
- C0011 1.00
- Operation Wocao 1.00
- Operation Dream Job 1.00