D
CyberRussia

Winter Vivern

Suspected state-linked cyber threat groupTrackedPending verification

Also known as: TA473, UAC-0114

CyberRUS
Identification silhouette. Not drawn to scale between entries.
Fact cardConfidence · Source
System
TypeSuspected state-linked cyber threat group
Alternative designationsTA473, UAC-0114
ProliferationOrigin country only
Active since2020At least 2020Med[1]
MITRE ATT&CK IDG1035High[1]
Capabilities
ATT&CK techniques used27ATT&CK v20.1High[1]
Attribution and activity
Attributed sponsorLinked to Russian and Belarusian interestsMed[1]
TargetsWinter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims.Med[1]
Notes
Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.
Summary

Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control.

Draft entry. Values come from the cited public sources and are awaiting editor verification.
CompareJSON
Operators
Russia
Sources
  1. Winter Vivern, Group G1035, MITRE ATT&CK
    Published/updated 2026-07-31 · Tier 2 · checked 2026-11-08
Change log
  • 2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G1035)