Winter Vivern is a cyberespionage group primarily targeting European governments.
Winter Vivern is a cyberespionage group active since at least 2020. It targets governments, primarily in Germany, Europe, and Central Asia. Key TTPs include Spearphishing Attachments, Drive-by Compromise, and a custom PowerShell backdoor. Defenders should focus on detecting obfuscated JavaScript payloads, C2 traffic via Web Protocols from VPS/Web Services, and credential theft attempts through Web Portal Capture.
Winter Vivern is a cyberespionage group first revealed by DomainTools in 2021. It is thought to have been active since at least 2020 and it targets governments in Europe and Central Asia. To compromise its targets, the group uses malicious documents, phishing websites, and a custom PowerShell backdoor.
Monitor network traffic for suspicious Vulnerability Scanning activities.
Monitor Virtual Private Server and Web Services usage and prevent creation of suspicious infrastructure.
Use user education and web application firewalls to prevent Drive-by Compromise and Spearphishing Attachment.
Monitor endpoints for suspicious Command and Scripting Interpreter and JavaScript execution.
Analyze system and network logs to detect Masquerade Task or Service and Deobfuscate/Decode Files or Information.
Monitor system logs to detect suspicious System Owner/User Discovery and System Information Discovery activities.
Monitor and restrict user activity to prevent Web Portal Capture and Screen Capture.
Monitor network traffic to detect suspicious Web Protocols and Ingress Tool Transfer activities.
Monitor and restrict data transfer to prevent Automated Exfiltration.
Winter Vivern targets governments primarily in Germany, Europe, and Central Asia.
The group uses Spearphishing Attachments, Drive-by Compromise, a custom PowerShell backdoor, and Web Portal Capture for credential theft.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.