Skip to content

Silence

Silence is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank's Automated Workstation Client, ATMs, and card processing.

ATT&CK ID: G0091
Techniques: 25
Tools: 3

Also tracked as Whisper Spider

Techniques

Resource Development

Obtain Capabilities

Initial Access

Valid Accounts Phishing

Execution

Scheduled Task/Job Command and Scripting Interpreter Software Deployment Tools Native API User Execution System Services

Persistence

Scheduled Task/Job Valid Accounts Modify Registry Boot or Logon Autostart Execution

Privilege Escalation

Scheduled Task/Job Process Injection Valid Accounts Boot or Logon Autostart Execution

Stealth

Obfuscated Files or Information Masquerading Process Injection Indicator Removal Valid Accounts System Binary Proxy Execution

Defense Impairment

Modify Registry Subvert Trust Controls

Credential Access

OS Credential Dumping

Discovery

Remote System Discovery

Lateral Movement

Remote Services Software Deployment Tools

Collection

Screen Capture Video Capture

Command and Control

Proxy Ingress Tool Transfer Non-Standard Port

Software

Empire · SDelete · Winexe

MITRE ATT&CK All threat actors