Winter Vivern

Names and who uses them

• Winter VivernOur name
• UAC-0114MITRE ATT&CK
• TA473Proofpoint

Targets

Sectors: Government, NGOs and think tanks

Regions: Europe, United States

Known techniques

• T1020Automated Exfiltration
• T1033System Owner/User Discovery
• T1036Masquerading
• T1036.004Masquerade Task or Service
• T1041Exfiltration Over C2 Channel
• T1053.005Scheduled Task
• T1056.003Web Portal Capture
• T1059Command and Scripting Interpreter
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1059.007JavaScript
• T1071.001Web Protocols
• T1082System Information Discovery
• T1083File and Directory Discovery
• T1105Ingress Tool Transfer
• T1113Screen Capture
• T1114.001Local Email Collection
• T1119Automated Collection
• T1140Deobfuscate/Decode Files or Information
• T1189Drive-by Compromise
• T1190Exploit Public-Facing Application
• T1204.001Malicious Link
• T1566.001Spearphishing Attachment
• T1583.001Domains
• T1583.003Virtual Private Server
• T1584.006Web Services
• T1595.002Vulnerability Scanning