Loading malware…
SILENTLOOP is a PowerShell-based backdoor and persistence component used in attacks against Windows systems. It executes commands, automatically updates its configuration, and retrieves the current command-and-control server address from a Telegram channel. It also supports fallback mechanisms for determining the command-and-control address, allowing operators to change infrastructure while maintaining access to compromised systems.
SILENTLOOP has been deployed alongside AGINGFLY in UAC-0247 campaigns targeting Ukrainian local government bodies and municipal healthcare institutions, including clinical hospitals and emergency medical services. These campaigns use humanitarian-aid-themed phishing emails that direct recipients to download malicious archives. The associated infection chains use Windows shortcuts and HTML Applications to execute payloads. SILENTLOOP provides command execution and continued access within a broader toolset used for espionage and data theft.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
PhantomCaptcha (UAC-0244) [...] déployant AGINGFLY [...], SILENTLOOP, CHROMELEVATOR, ZAPiXDESK.
PhantomCaptcha (UAC-0244) [...] déployant AGINGFLY [...], SILENTLOOP, CHROMELEVATOR, ZAPiXDESK.
Another tool, SilentLoop, can execute commands and retrieve the current address of the attackers’ command-and-control server via a Telegram channel.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
The attacks typically began with phishing emails posing as discussions about proposals for humanitarian aid. Victims were asked to follow a link that led to the download of a malicious archive file.
Victims were asked to follow a link that led to the download of a malicious archive file.
For persistence, the attackers deployed the malware AGINGFLY alongside a PowerShell script, SILENTLOOP, which manages commands, updates configuration, and retrieves C2 server data via Telegram with backup mechanisms.
CERT-UA said AgingFly allows attackers to remotely control an infected computer, enabling them to execute commands... Another tool, SilentLoop, can execute commands...
To maintain a persistent foothold, the campaign also uses a PowerShell script named SILENTLOOP, which automatically runs commands, updates its configuration, and retrieves the latest C2 server IP address from a Telegram channel.
For persistence, the attackers deployed the malware AGINGFLY alongside a PowerShell script, SILENTLOOP, which manages commands, updates configuration, and retrieves C2 server data via Telegram with backup mechanisms.
For persistence, the attackers deployed the malware AGINGFLY alongside a PowerShell script, SILENTLOOP, which manages commands, updates configuration, and retrieves C2 server data via Telegram with backup mechanisms.
obtain the current IP address of the management server from a Telegram channel, and fall back to alternative mechanisms for determining the command-and-control (C2) address
Another tool, SilentLoop, can execute commands and retrieve the current address of the attackers’ command-and-control server via a Telegram channel.
Комунікація із сервером управління здійснюється за допомогою вебсокетів...
Also downloaded to the infected machine is a malware family dubbed AGINGFLY and a PowerShell script referred to as SILENTLOOP
retrieves the latest C2 server IP address from a Telegram channel. If the primary Telegram source fails, SILENTLOOP also supports backup mechanisms to find the C2 address.
38 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.