Loading threat actor…
Silent Skimmer is a financially motivated payment-card skimming threat actor associated with intrusions into organizations that host or operate payment infrastructure and payment gateways. The actor is linked to a 2024 activity cluster tracked as CL-CRI-0941, which targeted payment ecosystem organizations through compromise of internet-facing web servers. Observed operations involved exploitation of Telerik UI vulnerabilities to obtain access to victim environments, followed by collection of payment information. Reported post-compromise tooling indicates a capability set consistent with sustained server-side intrusion and hands-on-keyboard activity, including remote access, tunneling, privilege escalation, and persistence. The actor’s tradecraft centers on compromising web infrastructure rather than browser-side skimming alone, enabling access to backend payment-processing environments and associated data flows. Silent Skimmer is best understood as a payment-focused intrusion actor specializing in theft of payment data from organizations in the payments supply chain. The associated CL-CRI-0941 activity demonstrates initial access via exploitation of vulnerable web applications, followed by post-exploitation actions to maintain access and facilitate data theft.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.