Trusted Design

Winter Vivern

G1035 · MITRE Pageへのリンク

脅威アクターの詳細

Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control.(Citation: DomainTools WinterVivern 2021)(Citation: SentinelOne WinterVivern 2023)(Citation: CERT-UA WinterVivern 2023)(Citation: ESET WinterVivern 2023)(Citation: Proofpoint WinterVivern 2023)

別名・別称

Winter Vivern
TA473
UAC-0114

利用した攻撃手法

• T1053.005 - Scheduled Task
• T1113 - Screen Capture
• T1033 - System Owner/User Discovery
• T1059.007 - JavaScript
• T1114.001 - Local Email Collection
• T1566.001 - Spearphishing Attachment
• T1119 - Automated Collection
• T1082 - System Information Discovery
• T1140 - Deobfuscate/Decode Files or Information
• T1190 - Exploit Public-Facing Application
• T1583.001 - Domains
• T1036 - Masquerading
• T1595.002 - Vulnerability Scanning
• T1056.003 - Web Portal Capture
• T1059 - Command and Scripting Interpreter
• T1020 - Automated Exfiltration
• T1583.003 - Virtual Private Server
• T1083 - File and Directory Discovery
• T1036.004 - Masquerade Task or Service
• T1041 - Exfiltration Over C2 Channel
• T1059.001 - PowerShell
• T1584.006 - Web Services
• T1059.003 - Windows Command Shell
• T1189 - Drive-by Compromise
• T1071.001 - Web Protocols
• T1105 - Ingress Tool Transfer
• T1204.001 - Malicious Link

関連するCVE (攻撃手法に関連)

• CVE-2013-3906 (T1584.006)
• CVE-2013-6282 (T1584.006)
• CVE-2014-0322 (T1204.001)
• CVE-2015-2419 (T1204.001)
• CVE-2016-0189 (T1204.001)
• CVE-2014-4114 (T1204.001)
• CVE-2015-1770 (T1204.001)
• CVE-2012-1856 (T1204.001)
• CVE-2015-2545 (T1204.001)
• CVE-2015-2546 (T1204.001)
• CVE-2014-6332 (T1204.001)
• CVE-2017-0199 (T1204.001)
• CVE-2017-12149 (T1204.001)
• CVE-2015-2424 (T1204.001)
• CVE-2015-0097 (T1204.001)
• CVE-2012-0158 (T1204.001)
• CVE-2014-1761 (T1190)
• CVE-2015-2502 (T1204.001)
• CVE-2014-6271 (T1204.001)
• CVE-2014-4113 (T1204.001)
• CVE-2012-1889 (T1584.006)
• CVE-2015-1641 (T1204.001)
• CVE-2015-1701 (T1204.001)
• CVE-2012-4969 (T1204.001)
• CVE-2017-0263 (T1204.001)
• CVE-2017-0261 (T1204.001)
• CVE-2017-0262 (T1204.001)
• CVE-2016-6532 (T1114.001)
• CVE-2017-3212 (T1595.002)
• CVE-2025-55182 (T1204.001)
• CVE-2014-6352 (T1584.006)
• CVE-2015-0016 (T1204.001)
• CVE-2010-3333 (T1204.001)
• CVE-2012-4792 (T1204.001)
• CVE-2013-0074 (T1204.001)
• CVE-2013-2551 (T1204.001)
• CVE-2014-1776 (T1204.001)
• CVE-2012-1876 (T1204.001)
• CVE-2015-0057 (T1204.001)
• CVE-2012-2539 (T1204.001)
• CVE-2015-0071 (T1204.001)
• CVE-2015-1761 (T1204.001)
• CVE-2013-3660 (T1204.001)
• CVE-2010-0806 (T1204.001)
• CVE-2013-7331 (T1584.006)
• CVE-2015-2360 (T1204.001)
• CVE-2014-4148 (T1204.001)
• CVE-2011-3402 (T1204.001)
• CVE-2014-6324 (T1204.001)
• CVE-2015-2426 (T1204.001)
• CVE-2008-1436 (T1083)
• CVE-2010-0232 (T1204.001)
• CVE-2010-4398 (T1204.001)
• CVE-2015-2387 (T1204.001)
• CVE-2009-3129 (T1204.001)
• CVE-2010-2572 (T1204.001)
• CVE-2011-1255 (T1204.001)
• CVE-2011-0611 (T1059.003)
• CVE-2017-8570 (T1204.001)
• CVE-2017-0001 (T1204.001)
• CVE-2017-0143 (T1204.001)
• CVE-2025-31125 (T1204.001)
• CVE-2025-55183 (T1204.001)
• CVE-2025-55184 (T1204.001)
• CVE-2010-1553 (T1204.001)
• CVE-2015-2853 (T1204.001)
• CVE-2017-16929 (T1204.001)
• CVE-2013-5990 (T1204.001)
• CVE-2015-0310 (T1584.006)
• CVE-2015-5119 (T1204.001)
• CVE-2015-5122 (T1204.001)
• CVE-2015-7645 (T1204.001)
• CVE-2015-3043 (T1204.001)
• CVE-2015-3090 (T1204.001)
• CVE-2015-3113 (T1584.006)
• CVE-2015-2590 (T1204.001)
• CVE-2013-2094 (T1204.001)
• CVE-2016-1010 (T1204.001)
• CVE-2016-1019 (T1584.006)
• CVE-2016-0984 (T1204.001)
• CVE-2016-1001 (T1584.006)
• CVE-2016-0998 (T1204.001)
• CVE-2015-0313 (T1204.001)
• CVE-2015-0359 (T1204.001)
• CVE-2015-5130 (T1204.001)
• CVE-2015-5134 (T1204.001)
• CVE-2015-5539 (T1204.001)
• CVE-2015-5557 (T1204.001)
• CVE-2015-5563 (T1204.001)
• CVE-2015-5559 (T1204.001)
• CVE-2015-5540 (T1204.001)
• CVE-2015-5561 (T1204.001)
• CVE-2015-5551 (T1204.001)
• CVE-2015-5564 (T1204.001)
• CVE-2015-5565 (T1204.001)
• CVE-2015-5550 (T1204.001)
• CVE-2015-5566 (T1204.001)
• CVE-2015-5127 (T1204.001)
• CVE-2015-5556 (T1204.001)
• CVE-2015-3628 (T1083)
• CVE-2016-1898 (T1204.001)
• CVE-2016-1897 (T1204.001)
• CVE-2016-1287 (T1190)
• CVE-2015-7261 (T1204.001)
• CVE-2015-8286 (T1190)
• CVE-2015-8287 (T1190)
• CVE-2016-9494 (T1204.001)
• CVE-2015-0311 (T1204.001)
• CVE-2015-0932 (T1190)
• CVE-2012-0056 (T1190)
• CVE-2010-3081 (T1083)
• CVE-2015-0336 (T1204.001)
• CVE-2014-3153 (T1083)
• CVE-2014-4322 (T1083)
• CVE-2015-3636 (T1083)
• CVE-2015-3105 (T1584.006)
• CVE-2014-0497 (T1584.006)
• CVE-2012-0507 (T1204.001)
• CVE-2014-8439 (T1584.006)
• CVE-2014-0569 (T1584.006)
• CVE-2014-0515 (T1584.006)
• CVE-2014-0556 (T1204.001)
• CVE-2015-5560 (T1584.006)
• CVE-2014-9163 (T1584.006)
• CVE-2012-1723 (T1204.001)
• CVE-2014-8440 (T1204.001)
• CVE-2010-1297 (T1204.001)
• CVE-2010-2884 (T1059.003)
• CVE-2010-2883 (T1059.003)
• CVE-2013-0634 (T1584.006)
• CVE-2014-7247 (T1204.001)
• CVE-2013-2595 (T1190)
• CVE-2015-4902 (T1204.001)
• CVE-2023-1389 (T1204.001)
• CVE-2025-24893 (T1204.001)
• CVE-2025-34026 (T1204.001)
• CVE-2025-66478 (T1083)
• CVE-2026-0723 (T1083)
• CVE-2026-20127 (T1204.001)
• CVE-2014-0329 (T1204.001)
• CVE-2015-6585 (T1583.003)
• CVE-2012-4681 (T1204.001)
• CVE-2015-3785 (T1083)
• CVE-2015-5897 (T1041)
• CVE-2015-4495 (T1189)
• CVE-2016-1990 (T1083)
• CVE-2016-1991 (T1083)
• CVE-2015-2852 (T1204.001)
• CVE-2015-2854 (T1204.001)
• CVE-2015-6022 (T1204.001)
• CVE-2012-3213 (T1204.001)
• CVE-2012-1258 (T1083)
• CVE-2011-3544 (T1204.001)
• CVE-2017-17215 (T1204.001)
• CVE-2013-2465 (T1204.001)
• CVE-2010-0188 (T1204.001)
• CVE-2013-2678 (T1204.001)
• CVE-2014-3393 (T1083)
• CVE-2014-2273 (T1083)
• CVE-2014-3897 (T1204.001)
• CVE-2012-0611 (T1204.001)
• CVE-2016-4117 (T1584.006)
• CVE-2025-68645 (T1204.001)
• CVE-2015-5477 (T1036.004)
• CVE-2012-5054 (T1584.006)
• CVE-2025-54313 (T1584.006)
• CVE-2013-0641 (T1059.003)
• CVE-2013-0640 (T1059.003)
• CVE-2014-8361 (T1071.001)
• CVE-2015-8562 (T1204.001)
• CVE-2015-6036 (T1204.001)
• CVE-2016-9496 (T1204.001)
• CVE-2016-9495 (T1204.001)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る