{
  "id": "winter-vivern",
  "name": "Winter Vivern",
  "aliases": [
    "TA473",
    "UAC-0114"
  ],
  "domain": "cyber",
  "country": "RUS",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "RUS"
  ],
  "summary": "Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Linked to Russian and Belarusian interests",
      "src": [
        "mitre-g1035"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2020,
      "src": [
        "mitre-g1035"
      ],
      "conf": "medium",
      "note": "At least 2020"
    },
    {
      "k": "attack_id",
      "v": "G1035",
      "src": [
        "mitre-g1035"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims.",
      "src": [
        "mitre-g1035"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 27,
      "src": [
        "mitre-g1035"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G1035)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/winter-vivern.html",
  "sources": {
    "mitre-g1035": {
      "title": "Winter Vivern, Group G1035",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G1035/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}