SilverScreen
SilverScreen is a custom post-exploitation surveillance tool used in intrusions attributed to the China-linked threat operation “Silver Dragon” (assessed to operate under the APT41 umbrella). It is described as a .NET screen-monitoring utility that covertly captures periodic screenshots of user activity across all connected displays, including precise cursor positioning. Reported behavior includes silently capturing screenshots at regular intervals, using change-detection to limit disk usage, compressing the captured images, and storing them locally for later exfiltration. SilverScreen has been observed deployed alongside other Silver Dragon tooling such as the GearDoor .NET backdoor (which uses Google Drive for file-based C2) and SSHcmd (an SSH-based remote command execution/file transfer utility), as part of broader cyberespionage campaigns targeting government and public sector organizations in Southeast Asia and Europe. No specific file hashes, domains, or other direct IoCs for SilverScreen itself are provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Recent operations used the GearDoor backdoor with SSHcmd and SilverScreen, enabling remote access, covert screen capture, and stealthy control...
Recent operations used the GearDoor backdoor with SSHcmd and SilverScreen, enabling remote access, covert screen capture, and stealthy control...
Other tools, including the screenshot-capturing SilverScreen... have also been harnessed by the hacking group.
Techniques & procedures
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques"the group breaks into networks by exploiting public-facing internet servers"
"using phishing emails... to infiltrate government networks" and "gains initial access... sending phishing emails with malicious attachments."
"using phishing emails, malicious Windows shortcut files... In one phishing campaign, attackers sent LNK files that triggered PowerShell commands".
Execution
3 techniquesPrivilege Escalation
1 techniqueStealth
2 techniquesCollection
2 techniques"...compresses them, and stores them for later exfiltration."
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Tool used for covert screen capture and interactive control as part of post-exploitation activity.
Tool used to capture screenshots from compromised systems, supporting espionage and collection objectives.
A custom post-exploitation utility used for screen capture on compromised systems.
Post-exploitation utility used for screen capture on compromised systems.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.