Who is Winter Vivern?

Winter Vivern is a threat actor attributed to RU, also known as UNC4907, TAG-70, UAC-0114. This group is tracked in the Strobes VI threat intelligence database.

What vulnerabilities does Winter Vivern exploit?

Winter Vivern is known to exploit 2 CVEs. View the full list on the Strobes VI threat actor profile page.

Agentic AI · Pentesting

Ready for Agentic Automated Testing?

Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.

Zero false positives

PoC for every finding

30+ tools orchestrated

Book a Demo Learn More

Setup in 5 minutesSOC 2 & ISO 27001

Winter Vivern

Also known as: UNC4907, TAG-70, UAC-0114, TA473, TA-473

RUInformation theft and espionage

Exploited CVEs

Overview

Winter Vivern is a cyberespionage group first revealed by DomainTools in 2021. It is thought to have been active since at least 2020 and it targets governments in Europe and Central Asia. To compromise its targets, the group uses malicious documents, phishing websites, and a custom PowerShell backdoor.

Exploited Vulnerabilities

CVE ID	Action
CVE-2014-7169	View Details