Winter VivernThreat actor
- ta-473
- ta473
- tag-70
- UAC-0114
Winter Vivern is a cyberespionage group first revealed by DomainTools in 2021. It is thought to have been active since at least 2020 and it targets governments in Europe and Central Asia. To compromise its targets, the group uses malicious documents, phishing websites, and a custom PowerShell backdoor.From MISP Galaxy
Last reported 28 days ago, by SOCRadar1 report
ATT&CK techniques
6 of 17 · each with the sentence it comes from- T1003.001LSASS Memory
“T1003.001 LSASS Memory”
- T1021.006Windows Remote Management
“T1021.006 WinRM”
- T1036Masquerading
“Hunt for Sliver implant indicators, including process masquerading and beacon traffic to 46.8.236.121:11008 / 11009 at 60-second mTLS check-in intervals.”
- T1087.002Domain Account
“T1087.002 Domain Account Discovery”
- T1090.003Multi-hop Proxy
“T1090.003 Multi-hop Proxy”
- T1133External Remote Services
“T1133 External Remote Services”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Operation Talked: A Russia-Linked Cyber Espionage Campaign Targeting Ukraine’s Defense Industry“SOCRadar attributes this activity to a Russia-nexus actor with high confidence, based on TTP overlap with UAC-0056 / UAC-0114, Moscow-timezone activity, and Russian-language artifacts the actor left in their own shell history.”
Indicators in its reports
named in the reports above- 129.146.87[.]174in 1 report
- 130.12.182[.]216in 1 report
- db848d928afe4d2284a35bb112720e6fin 1 report
- 46.8.236[.]121in 1 report
- 24.106.41[.]154in 1 report
- 46.44.231[.]122in 1 report
- 213.96.47[.]74in 1 report
- 71.245.184[.]24in 1 report
- b2d46bfc25df83dd…c46257d13be8in 1 report
- e27f5b057a0de14ab32fb9e7462f04cfin 1 report
- 65d96bd51d8a1cbd…e9bd64103992in 1 report
- 3ba4e04fdcf73c267b89d91fc90f836fin 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.