Silence - G0091

Created: 2019-05-24T17:57:36.491Z

Modified: 2023-03-22T05:34:46.346Z

Contributors: Oleg Skulkin, Group-IB

Aliases

Silence,Whisper Spider

Description

Silence is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank's Automated Workstation Client, ATMs, and card processing.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017)

Techniques Used

Silence has obtained and modified versions of publicly-available tools like

Empire and

PsExec.(Citation: Group IB Silence Aug 2019) (Citation: SecureList Silence Nov 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1571|Non-Standard Port|

Silence has used port 444 when sending data about the system from the client to the server.(Citation: Group IB Silence Sept 2018)  |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.002|External Proxy|

Silence has used ProxyBot, which allows the attacker to redirect traffic from the current node to the backconnect server via Sock4\Socks5.(Citation: Group IB Silence Sept 2018)  |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1072|Software Deployment Tools|

Silence has used RAdmin, a remote software tool used to remotely control workstations and ATMs.(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1055|Process Injection|

Silence has injected a DLL library containing a Trojan into the fwmain32.exe process.(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Silence has used