- Category
- State · Attributed to a state or working for one.
- Origin
- Russia(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2020–2026
- Status
- Active
- ATT&CK
- G1035 · 27 techniques
- Sources
- 10 sources carry it
- Identifier
- GINC-APT-0072 · winter-vivern
RussiaWhat it is
Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CERT-UA
- UAC-0114
- Mandiant
- UNC4907
- Proofpoint
- TA473
- Recorded Future
- TAG-70
- Other names
- TA-473
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- MISP Galaxy (CFR tagging)Russia
- ThreatActor.info (Malpedia et al.)Russia · high
Targets
- Countries
- Georgia, Germany, India, Lithuania, Moldova, Poland, Slovakia, Tunisia, Ukraine, United States, Uzbekistan
- Sectors
- Defense, Government
Tools
The tools and malware families the sources tie to it.
- APERETIF
- Backdoor.Oldrea
- Cyber Eye RAT
- CyberGate
- POWERSOURCE
- POWERSTATS
- Power Loader
- PowerDuke
- PowerRAT
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de