Winter Vivern

Threat Actor
6 incidents First seen 2026-02-23 Last seen 2026-10-08
Overview

Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control.

Investigate in CTI Graph Login required Open in Dashboard
Threat ecosystem
Actors Malware Campaigns CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 190 30 techniques in ATT&CK since 2024-07-29 updated 2026-07-31 · v1.0
Activity by month (incidents)
2026-022026-10
Sectors targeted
government · 6aviation · 1defense · 1education · 1transportation · 1
Countries targeted
UA · 4NL · 3PT · 3AT · 2BE · 2BG · 2CH · 2CY · 2CZ · 2DE · 2DK · 2EE · 2
Origin
RU · 6CN · 2UA · 2AT · 1BE · 1BG · 1
Kinds of incident
Exploited Vulnerability · 5Vulnerability Disclosure · 3Data Breach · 1State-Sponsored & Espionage · 1
Techniques seen in incidents
T1588.006 - Vulnerabilities · 6Espionage · 4Phishing · 4T1059.007 - JavaScript · 4T1584.004 - Server · 3Exfiltration · 2Ransomware · 2Extortion · 1Impersonate · 1Lateral Movement · 1Privilege Escalation · 1Reconnaissance · 1T1059.001 - PowerShell · 1T1588.001 - Malware · 1
Related malware
Sednit · 2Sofacy · 2
Related CVEs
CVE-2025-66376 · 4CVE-2023-5631 · 2CVE-2025-48700 · 2CVE-2025-49113 · 2CVE-2025-68461 · 2CVE-2020-12641 · 1CVE-2020-35730 · 1CVE-2020-7796 · 1CVE-2021-44026 · 1CVE-2024-37383 · 1
ATT&CK techniques by tactic (30)
reconnaissance T1595.002 Vulnerability Scanning
resource development T1583.001 Domains T1583.003 Virtual Private Server T1584.006 Web Services
initial access T1189 Drive-by Compromise T1190 Exploit Public-Facing Application T1566.001 Spearphishing Attachment
execution T1053.005 Scheduled Task T1059 Command and Scripting Interpreter T1059.001 PowerShell T1059.003 Windows Command Shell T1059.007 JavaScript T1204.001 Malicious Link
persistence T1053.005 Scheduled Task
privilege escalation T1053.005 Scheduled Task
credential access T1056.003 Web Portal Capture
discovery T1033 System Owner/User Discovery T1082 System Information Discovery T1083 File and Directory Discovery
collection T1056.003 Web Portal Capture T1113 Screen Capture T1114.001 Local Email Collection T1119 Automated Collection
command and control T1071.001 Web Protocols T1105 Ingress Tool Transfer
exfiltration T1020 Automated Exfiltration T1041 Exfiltration Over C2 Channel
stealth T1036 Masquerading T1036.004 Masquerade Task or Service T1140 Deobfuscate/Decode Files or Information
Incident timeline
2026-10-08
INCIBE-CERT Avisos Security Affairs BleepingComputer SecurityWeek The Hacker News
2026-08-25
The Hacker News Security Affairs Security Affairs BleepingComputer BleepingComputer BleepingComputer
2026-07-23
Security Affairs BleepingComputer BleepingComputer Dark Reading
2026-04-24
Over 10,000 Zimbra servers vulnerable to ongoing XSS attacks
BleepingComputer
2026-03-19
Security Affairs The Hacker News BleepingComputer Security Affairs The Hacker News BleepingComputer
2026-02-23
The Hacker News BleepingComputer