Loading story…
Group-IB published research on Silence 2.0, describing an evolution of the Silence threat actor into a more globally focused operation targeting financial institutions. The report indicates the group has broadened its reach beyond earlier regional activity, refining its intrusion methods and operational tradecraft to support attacks against banks and related organizations in multiple countries.
The research frames Silence 2.0 as a financially motivated threat that continues to adapt its tooling, tactics, and targeting strategy to sustain intrusions and enable theft from the banking sector. The publication highlights the group’s international expansion and positions the activity as a significant threat for defenders in financial services monitoring organized cybercrime campaigns.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
Group-IB published the report "Silence 2.0: Going Global" as a threat research resource. No additional incident details are available in the provided reference content.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Research on the financially motivated **Silence** threat group shows its malware toolkit evolved beyond a basic downloader into a more capable intrusion platform used after initial compromise. Analysis of downloader samples observed from 2017 through early 2019 found that newer variants added host reconnaissance, collecting system details into `INFOCONTENT.TXT` for upload to command-and-control infrastructure, checking operating system and antivirus products, and changing persistence mechanisms from registry `Run` keys to an alternative scheduled task named **"Avi Capture"**. Later versions also expanded execution options, allowing operators to launch an EXE or register a DLL after receiving tasking from the C2 server. Separate analysis of a lesser-documented **.NET proxy** attributed to Silence indicates the group also developed tooling to move traffic through compromised systems inside networks that are normally isolated from the internet. The proxy, reportedly packed with **SmartAssembly**, reads a configuration file, selects a connection mode, and connects to a specified C2 while optionally logging status locally. Observed and intended modes included **`SocksServer`**, **`DirectBackConnector`**, **`ProxyBackConnector`**, and authenticated proxy options such as **`ProxyBackConnectorWithAuth`** and **`ProxyBackConnectorWithNtlmAuth`**, suggesting support for lateral access and credential-aware tunneling inside victim environments as the group refined its post-compromise operations.
Aug 14, 2026
The **Silent Ransom Group** — also tracked as **UNC3753**, **Luna Moth**, and **Chatty Spider** — has been targeting U.S. law firms and other professional, financial, insurance, and healthcare organizations with data-theft extortion campaigns that rely on social engineering instead of file encryption. FBI alerts and Google Mandiant reporting say the actors send invoice-themed phishing emails and follow up with voice calls impersonating internal IT or help desk staff, persuading employees to join screen-sharing sessions or install legitimate remote management tools such as AnyDesk, Zoho Assist, Bomgar, Splashtop, Syncro, Atera, and SuperOps. Once inside, the group rapidly searches document repositories and cloud stores for legal files, tax records, financial data, PII, and other sensitive material, then exfiltrates it with tools including WinSCP, hidden or renamed Rclone, Google Drive, Microsoft OneDrive, or victim-controlled file-sharing channels. Authorities said the campaign has escalated beyond remote access attempts to **in-person intrusions**, with imposters arriving at offices posing as technicians and connecting USB drives or external disks to steal data when remote social engineering fails. Mandiant said dozens of U.S. organizations were targeted between January and May, and in some cases the intrusion, theft, and extortion cycle was completed within a single business day, with ransom demands sent shortly after access ended. Researchers and the FBI linked the operation to the post-Conti cybercrime ecosystem and noted that its abuse of legitimate tools leaves few forensic artifacts, while Resecurity reported fast-flux infrastructure supporting leak sites including `business-data-leaks[.]com` and `ep6pheij[.]com`. The FBI and Google urged organizations to verify anyone claiming to be IT staff, restrict unauthorized remote management and VDI access, harden USB and removable-media controls, deploy phishing-resistant MFA, and closely monitor sensitive document systems.
Jun 29, 2026
Group-IB reported renewed activity by **APT SideWinder**, describing a sustained cyber-espionage campaign aimed at government, military, and maritime organizations across Asia. The operation was characterized by targeted intrusion activity and a recognizable tradecraft pattern that researchers said allowed them to track the actor across multiple incidents. The report said SideWinder continued to rely on spearphishing and malware delivery techniques tailored to regional targets, reinforcing the group’s role as a persistent intelligence threat rather than a financially motivated actor. Group-IB’s findings highlight SideWinder’s ongoing focus on sensitive institutions and critical sectors, with the campaign showing consistent operational behavior that supports attribution and threat hunting efforts.
Jul 12, 2026