Winter Vivern
Winter Vivern is classified as state-sponsored.
- Malware families
- 1
- Origin
- Russia
- Also known as
- 4
Winter Vivern is a cyberespionage group first revealed by DomainTools in 2021. It is thought to have been active since at least 2020 and it targets governments in Europe and Central Asia. To compromise its targets, the group uses malicious documents, phishing websites, and a custom PowerShell backdoor.
The group's reported origin is Russia.
The group is associated with 1 malware families.
Also known as: UAC-0114, TA473, TAG-70, TA-473
The group is associated with 1 malware families.
Malware families
- Unidentified JS 006 (Winter Wyvern)
Published reports on this actor:
- https://www.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espionage/
- https://www.domaintools.com/resources/blog/winter-vivern-a-look-at-re-crafted-government-maldocs
- https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/
Source: MISP Galaxy, Malpedia.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.