Procedure examples

Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.

Winter Vivern PowerShell scripts execute `whoami` to identify the executing user.

Winter Vivern created specially-crafted documents mimicking legitimate government or similar documents during phishing campaigns.

Winter Vivern has distributed malicious scripts and executables mimicking virus scanners.

Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.

Winter Vivern executed PowerShell scripts that would subsequently attempt to establish persistence by creating scheduled tasks objects to periodically retrieve and execute remotely-hosted payloads.

Winter Vivern registered and hosted domains to allow for creation of web pages mimicking legitimate government email logon sites to collect logon information.

Winter Vivern used XLM 4.0 macros for initial code execution for malicious document files.

Winter Vivern passed execution from document macros to PowerShell scripts during initial access operations. Winter Vivern used batch scripts that called PowerShell commands as part of initial access and installation operations.

Winter Vivern distributed Windows batch scripts disguised as virus scanners to prompt download of malicious payloads using built-in system tools.

Winter Vivern delivered malicious JavaScript to exploit targets when exploiting Roundcube Webmail servers.

Winter Vivern uses HTTP and HTTPS protocols for exfiltration and command and control activity.

Winter Vivern script execution includes basic victim information gathering steps which are then transmitted to command and control servers.

Winter Vivern delivered malicious JavaScript payloads capable of listing folders and emails in exploited email servers.

Winter Vivern executed PowerShell scripts to create scheduled tasks to retrieve remotely-hosted payloads.

Winter Vivern delivered PowerShell scripts capable of taking screenshots of victim machines.

Winter Vivern delivered malicious JavaScript payloads capable of exfiltrating email messages from exploited email servers.

Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.

Winter Vivern delivered exploit payloads via base64-encoded payloads in malicious email messages.

Winter Vivern created dedicated web pages mimicking legitimate government websites to deliver malicious fake anti-virus software.

Winter Vivern has exploited known and zero-day vulnerabilities in software usch as Roundcube Webmail servers and the "Follina" vulnerability.

Winter Vivern has mimicked legitimate government-related domains to deliver malicious webpages containing links to documents or other content for user execution.

Winter Vivern leverages malicious attachments delivered via email for initial access activity.

Winter Vivern registered domains mimicking other entities throughout various campaigns.

Winter Vivern used adversary-owned and -controlled servers to host web vulnerability scanning applications.

Winter Vivern has used compromised WordPress sites to host malicious payloads for download.

Winter Vivern has used remotely-hosted instances of the Acunetix vulnerability scanner.