Winter Vivern
Also reported as TA473, UAC-0114, TAG-70, TA-473 and UNC4907. Linked to Russia by two sources.
Reports per quarter
Techniques seen in the last two years
- T1566.001 3 reports in ATT&CK
- T1027 2 reports reports only
- T1041 2 reports in ATT&CK
- T1056.003 2 reports in ATT&CK
- T1087.003 2 reports reports only
- T1114.002 2 reports reports only
- T1190 2 reports in ATT&CK
- T1203 2 reports reports only
- T1583.001 2 reports in ATT&CK
- T1586.002 2 reports reports only
Show all 45 techniques Show fewer
- T1020 1 report in ATT&CK
- T1048.002 1 report reports only
- T1059.007 1 report in ATT&CK
- T1069 1 report reports only
- T1071.001 1 report in ATT&CK
- T1071.003 1 report reports only
- T1071.004 1 report reports only
- T1082 1 report in ATT&CK
- T1091 1 report reports only
- T1098.001 1 report reports only
- T1111 1 report reports only
- T1114.003 1 report reports only
- T1119 1 report in ATT&CK
- T1120 1 report reports only
- T1132.001 1 report reports only
- T1136 1 report reports only
- T1185 1 report reports only
- T1187 1 report reports only
- T1189 1 report in ATT&CK
- T1195 1 report reports only
- T1204.002 1 report reports only
- T1204.004 1 report reports only
- T1213 1 report reports only
- T1528 1 report reports only
- T1539 1 report reports only
- T1555.003 1 report reports only
- T1556.006 1 report reports only
- T1564.001 1 report reports only
- T1566.002 1 report reports only
- T1566.003 1 report reports only
- T1583.004 1 report reports only
- T1585.002 1 report reports only
- T1587.001 1 report reports only
- T1587.004 1 report reports only
- T1659 1 report reports only
Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.
Also listed by ATT&CK
CVEs named in reports
- CVE-2017-0144 KEV ransomware
- CVE-2020-35730 KEV
- CVE-2021-1732 KEV ransomware
- CVE-2021-35207
- CVE-2022-24682 KEV ransomware
- CVE-2022-27926 KEV
- CVE-2022-30190 KEV ransomware
- CVE-2023-23397 KEV
- CVE-2023-36884 KEV ransomware
- CVE-2023-37580 KEV
- CVE-2023-38831 KEV ransomware
- CVE-2023-43770 KEV
Show all 20 CVEs Show fewer
- CVE-2023-5631 KEV
- CVE-2024-11182 KEV
- CVE-2024-21413 KEV
- CVE-2024-27443 KEV
- CVE-2024-42009 KEV
- CVE-2024-9680 KEV ransomware
- CVE-2025-66376 KEV
- CVE-2025-8088 KEV ransomware
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
-
Winter Vivern - Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Winter Vivern - Threat Group Cards: A Threat Actor Encyclopedia
Show all 26 reports Show fewer
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Exploitation is a Dish Best Served Cold- Winter Vivern Uses Known Zimbra Vulnerability to Target Webmail Portals of NATO-Aligned Governments in Europe
-
Winter Vivern - Uncovering a Wave of Global Espionage
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Winter Vivern - Uncovering a Wave of Global Espionage
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Winter Vivern – all Summer
-
Winter Vivern- A Look At Re-Crafted Government MalDocs Targeting Multiple Languages
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Winter Vivern- A Look At Re-Crafted Government MalDocs Targeting Multiple Languages
Newest first. Details opens the report in Explore.