Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Winter Vivern · Unknown · assessed origin Russia · misp-galaxy + mitre-attack · refreshed 2026-10-06

Winter Vivern

  • UAC-0114
  • TA473
  • TAG-70
  • TA-473

MITRE G1035 ↗

Winter Vivern — ATT&CK roseWV

attack rose · 27 techniques across 9 tactics

What changed

ledger · newest first
  1. —todaynew CVE4 new CVEs: CVE-2020-35730, CVE-2022-27926, CVE-2022-30190, CVE-2023-5631

Analyst brief

misp-galaxy + mitre-attack

Winter Vivern is a cyberespionage group first revealed by DomainTools in 2021. It is thought to have been active since at least 2020 and it targets governments in Europe and Central Asia. To compromise its targets, the group uses malicious documents, phishing websites, and a custom PowerShell backdoor.

Observed targets (as stated by the sources)

1 countries · 0 sectors
GermanyAssessed origin: Russia

assessed origin · Russiaobserved targets · 1

countries · 1

  • Germany

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

27 techniques · 9 of 15 tactics

  1. Reconnaissance

    1 technique

  2. Resource development

    3 techniques

  3. Initial access

    3 techniques

  4. Execution

    6 techniques

  5. Stealth

    3 techniques

  6. Discovery

    3 techniques

  7. Collection

    4 techniques

  8. Command and control

    2 techniques

  9. Exfiltration

    2 techniques

select a technique

CVEs Winter Vivern is cited as exploiting

none on KEV
  1. CVE-2023-56312026-10-17
    1. “Matthieu Faou gives us reporting that shows this threat actor has continued the trend of exploiting web vulnerabilities in email servers via email. Exploitation of the XSS vulnerability, assigned CVE-2023-5631 , can be done remotely by sending a specially crafted email message.”

      cited as exploiting · named nearby · source: ctoatncsc.substack.com ↗ · 2026-10-17

  2. CVE-2022-279262026-10-17
    1. “the APT group Winter Vivern (aka TA473) had been exploiting the CVE-2022-27926 vulnerability, targeting webmail portals of military, government, and diplomatic entities of European countries.”

      cited as exploiting · source: welivesecurity.com ↗ · 2026-10-17

    2. “Researchers have observed TA473, a newly minted advanced persistent threat (APT) actor tracked by Proofpoint, exploiting Zimbra vulnerability CVE-2022-27926 to abuse publicly facing Zimbra hosted webmail portals.”

      cited as exploiting · source: proofpoint.com ↗ · 2026-10-17

    3. “In March 2023, Winter Vivern used a known XSS vulnerability ( CVE-2022-27926 ) in the Zimbra mail portal in order to steal webmail credentials of diplomats of several European countries.”

      cited as exploiting · source: welivesecurity.com ↗ · 2026-10-17

  3. CVE-2022-301902026-10-17
    1. “This threat actor has been observed employing opportunistic exploits to target its victims which include popular 1-day vulnerabilities like the CVE-2022-30190 (“Follina”) exploit disclosed in May 2022.”

      cited as exploiting · named nearby · source: proofpoint.com ↗ · 2026-10-17

  4. CVE-2020-357302026-10-17
    1. “In particular, we observed that the group exploited CVE-2020-35730 , another XSS vulnerability in Roundcube, in August and September 2023.”

      cited as exploiting · named nearby · source: welivesecurity.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

11 sources
  1. 1.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espiona…
  2. 2.domaintools.com/resources/blog/winter-vivern-a-look-at-re-crafted-gove…
  3. 3.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulne…
  4. 4.proofpoint.com/us/blog/threat-insight/exploitation-dish-best-served-c…
  5. 5.socprime.com/blog/uac-0114-group-aka-winter-vivern-attack-detection…
  6. 6.cybersecuritynews.com/russian-hackers-xss-flaw
  7. 7.recordedfuture.com/russia-aligned-tag-70-targets-european-government-and-…
  8. 8.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherh…
  9. 9.attack.mitre.org/groups/G1035
  10. 10.cert.gov.ua/article/3761104
  11. +1 more in the JSON record

Track Winter Vivern on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.