Winter Vivern
Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control.
- ATT&CK ID
- G1035
- Techniques
- 22
- Tools
- 0
Also tracked as TA473 · UAC-0114
Techniques
Reconnaissance
Resource Development
Acquire InfrastructureCompromise Infrastructure
Initial Access
Drive-by CompromiseExploit Public-Facing ApplicationPhishing
Execution
Scheduled Task/JobCommand and Scripting InterpreterUser Execution
Persistence
Privilege Escalation
Stealth
MasqueradingDeobfuscate/Decode Files or Information
Credential Access
Discovery
System Owner/User DiscoverySystem Information DiscoveryFile and Directory Discovery
Collection
Input CaptureScreen CaptureEmail CollectionAutomated Collection
Command and Control
Application Layer ProtocolIngress Tool Transfer