Silence

Silence, also known as Silence Group and Whisper Spider, is a Russia-based, financially motivated cybercriminal group targeting banks and other financial institutions. Its targets include organizations in Russia, Kazakhstan, Ukraine, Azerbaijan, and Poland, with additional targeting across multiple regions. The group uses spearphishing emails with malicious Office documents, compiled HTML attachments, Windows shortcuts, and ZIP archives for initial access. Within compromised Windows environments, Silence uses Nmap to map corporate networks and identify vulnerable hosts. It harvests credentials from Windows Local Security Authority process memory using the Mimikatz-based Farse6.1 utility, then abuses compromised accounts to access additional systems and escalate privileges. Its lateral-movement techniques include Remote Desktop Protocol. Silence also obtains and modifies publicly available tools, including Empire and PsExec, and uses Windows command-line execution and scheduled tasks to stage operations. Silence establishes persistence through Windows Registry autorun entries and Startup folders. Its defense-evasion techniques include environment-variable string substitution for command obfuscation and injection of Trojan-bearing DLLs into other processes. The group developed Truebot, a first-stage downloader capable of collecting system information, capturing screenshots, and delivering additional payloads. Truebot is also used by other criminal actors; its presence alone does not establish Silence attribution.