Winter Vivern
IntrusionSet · ATTACK:enterprise:G1035
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1035",
"title": "Winter Vivern",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1035",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--75a07184-a7e5-4222-95a1-a04dbc96a29c",
"external_id": "G1035",
"domain": "enterprise",
"created": "2024-07-29T22:23:03.779Z",
"modified": "2026-07-31T18:48:02.493Z",
"version": "1.0",
"aliases": [
"Winter Vivern",
"TA473",
"UAC-0114"
],
"tactics": [
],
"source_references": [
{
"source_name": "UAC-0114"
},
{
"source_name": "TA473"
},
{
"source_name": "CERT-UA WinterVivern 2023",
"url": "https://cert.gov.ua/article/3761104"
},
{
"source_name": "DomainTools WinterVivern 2021",
"url": "https://www.domaintools.com/resources/blog/winter-vivern-a-look-at-re-crafted-government-maldocs/"
},
{
"source_name": "ESET WinterVivern 2023",
"url": "https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/"
},
{
"source_name": "Proofpoint WinterVivern 2023",
"url": "https://www.proofpoint.com/us/blog/threat-insight/exploitation-dish-best-served-cold-winter-vivern-uses-known-zimbra-vulnerability"
},
{
"source_name": "SentinelOne WinterVivern 2023",
"url": "https://www.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espionage/"
}
]
}Explicit source assertions (27)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1059
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--120adfe2-5ad8-49bb-b6e8-e474b306814b
DomainTools WinterVivern 2021ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--226403d7-7318-4f15-9cf6-83fd6684c33f
CERT-UA WinterVivern 2023 · SentinelOne WinterVivern 2023ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1056.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--22c42efe-5bbe-464a-82de-0cb2f032bf9a
SentinelOne WinterVivern 2023ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--284843c3-18d0-4ddb-aab5-4588a6ec400e
SentinelOne WinterVivern 2023ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1583.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ce803ed-e46c-4e07-980d-3322325a863e
SentinelOne WinterVivern 2023ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d5fa465-7221-4ba5-9c39-9c51e9e102db
ESET WinterVivern 2023ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63065346-29bd-40de-9826-04646cc5a9a6
CERT-UA WinterVivern 2023 · DomainTools WinterVivern 2021 · SentinelOne WinterVivern 2023ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6f2f2822-6858-4c8c-9d33-62d2ee17f1af
SentinelOne WinterVivern 2023ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71cd5162-6352-4e19-9a02-2d8510333f6a
CERT-UA WinterVivern 2023ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1189
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8e69eee2-ee5b-4db2-a39e-4446be3afc8f
CERT-UA WinterVivern 2023ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1119
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--954a1ee1-454a-4d1a-b922-620f755887b3
CERT-UA WinterVivern 2023ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ac9c832-68cb-48ce-85eb-f0b8334fe48d
ESET WinterVivern 2023ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a16a3223-06a6-453d-b044-f683bda1bf2a
CERT-UA WinterVivern 2023ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0aa8d46-dca7-442f-8ddb-c2ed5835732e
DomainTools WinterVivern 2021ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b20bd897-988b-422b-82d1-61e155d34115
ESET WinterVivern 2023 · Proofpoint WinterVivern 2023ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b32c0514-83e8-4822-98fd-f675896324c1
SentinelOne WinterVivern 2023ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b471fc88-4709-4e9d-91a4-8072d15e70a3
CERT-UA WinterVivern 2023ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc2770c2-2d08-4b28-bc46-e0451c391f01
DomainTools WinterVivern 2021ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1584.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bd4ff89c-7088-4eb2-85bd-a639fc528bf6
SentinelOne WinterVivern 2023ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c3c1440f-4585-47a6-8864-e5d3a22c2b84
SentinelOne WinterVivern 2023ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1583.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cfa8ecb0-28e4-4e8a-bef6-4a8692ff6721
DomainTools WinterVivern 2021ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d0ddfe52-8e91-4576-b7e2-912b51eca87d
DomainTools WinterVivern 2021ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d1e53f99-5dec-4a52-948e-307202b76d0f
CERT-UA WinterVivern 2023 · SentinelOne WinterVivern 2023ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--de9a5ad0-b680-493d-9aeb-95070d003033
CERT-UA WinterVivern 2023 · SentinelOne WinterVivern 2023ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e0922165-ba76-4dc0-8625-b77a82818d77
ESET WinterVivern 2023ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1114.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2ae5489-3473-48d6-ba26-f5a8391ad106
ESET WinterVivern 2023ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f31ff00d-794c-41ef-ab92-65bf7ff25169
CERT-UA WinterVivern 2023 · DomainTools WinterVivern 2021