SliverScreen
SilverScreen is a .NET screen-monitoring implant associated with the China-nexus activity cluster Silver Dragon, which Check Point assesses with high confidence is likely operating under the APT41 umbrella. It has been used in campaigns targeting organizations across Europe and Southeast Asia since at least mid-2024, with a particular focus on government entities. Silver Dragon gains initial access through exploitation of public-facing servers and phishing emails with malicious attachments, then deploys Cobalt Strike to establish an early foothold; SilverScreen is one of the custom post-exploitation tools deployed alongside GearDoor and SSHcmd. Its documented capability is covert screenshot capture: it captures periodic screenshots of user activity, includes cursor context, uses change detection, and compresses captured images with JPEG and then GZIP into a local data file. The content does not provide specific SilverScreen file hashes, domains, or other standalone IOCs.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Silver Dragon deployed ... SliverScreen, a screen-monitoring tool used to capture periodic screenshots of user activity.
"...SliverScreen, a screen-monitoring tool used to capture periodic screenshots of user activity."
"...SliverScreen, a screen-monitoring tool used to capture periodic screenshots of user activity."
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A screen-capture/surveillance utility used to periodically screenshot user activity.
A .NET covert screen-monitoring implant that runs in the active user session (relaunching from SYSTEM via token impersonation if needed), captures multi-monitor screenshots with cursor context, uses change-detection to limit captures, and compresses output (JPEG then GZIP) into a local structured data file for later collection/exfiltration.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.