Winter Vivern
Winter Vivern is a Russia-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 7 sectors, including Government and Manufacturing, in 19 countries, including the United States and India. It uses 46 MITRE ATT&CK techniques and exploits 6 known CVEs.
- UAC-0114
- TA473
- TAG-70
- UNC4907
- Origin
- Russia
- Techniques
- 46
- Exploited CVEs
- 6
- First seen
- Jan 1, 2020
- Last seen
- Oct 25, 2023
- Record updated
Who They Target.
About Winter Vivern.
Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control.
Last updated Sep 30, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.