Loading story…
Research on the financially motivated Silence threat group shows its malware toolkit evolved beyond a basic downloader into a more capable intrusion platform used after initial compromise. Analysis of downloader samples observed from 2017 through early 2019 found that newer variants added host reconnaissance, collecting system details into INFOCONTENT.TXT for upload to command-and-control infrastructure, checking operating system and antivirus products, and changing persistence mechanisms from registry Run keys to an alternative scheduled task named "Avi Capture". Later versions also expanded execution options, allowing operators to launch an EXE or register a DLL after receiving tasking from the C2 server.
Separate analysis of a lesser-documented .NET proxy attributed to Silence indicates the group also developed tooling to move traffic through compromised systems inside networks that are normally isolated from the internet. The proxy, reportedly packed with SmartAssembly, reads a configuration file, selects a connection mode, and connects to a specified C2 while optionally logging status locally. Observed and intended modes included SocksServer, DirectBackConnector, ProxyBackConnector, and authenticated proxy options such as ProxyBackConnectorWithAuth and ProxyBackConnectorWithNtlmAuth, suggesting support for lateral access and credential-aware tunneling inside victim environments as the group refined its post-compromise operations.
See the actors and campaigns active against you right now.
7 events from the most recent confirmed update back to the earliest known activity.
In February 2019, Silence reportedly stole about $400,000 from the Russian bank Omsk IT Bank. The incident is cited in the report as one of the group's successful bank theft operations.
In August 2018, Group-IB published research on Silence that mentioned a proxy tool used to route traffic to and from infected devices on networks normally isolated from the Internet. This appears to be the earliest public reference in the provided sources to the Silence proxy capability.
In later samples observed after the late-2018 variant, the Silence downloader added antivirus process checks, alternate persistence via either a Run key or a scheduled task named "Avi Capture," and the ability to either execute an EXE or register a DLL. The samples also shifted C2 communications to a Winsock-based implementation.
By late 2018, newer Silence downloader versions had added command-line based information gathering, stored results in ProgramData\INFOCONTENT.TXT, and uploaded that file to the C2 server. These versions also changed persistence behavior and updated task parsing logic.
In October 2017, Kaspersky Securelist publicly described a Silence downloader sample at a high level. The sample functioned as an early-stage malware component that contacted C2, established registry Run-key persistence, downloaded and executed payloads, or deleted itself on command.
In July 2016, Silence carried out its first recorded attack, attempting to steal funds via Russia’s AWS CBR inter-bank transaction system. The attempt failed because the payment order was improperly prepared and bank employees suspended the transaction.
Analysis of two Silence proxy samples showed the malware was still under development: an older sample lacked code for the ProxyBackConnector case, while a newer sample implemented it. The proxy supported or was intended to support multiple traffic-routing modes, including SOCKS and NTLM-authenticated proxying.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
6 references tracked. Mallory keeps watching after this page renders.
group-ib.com
Open sourcenorfolkinfosec.com
Open sourcenorfolkinfosec.com
Open sourcezdnet.com
Open sourcegroup-ib.com
Open sourcecert.ssi.gouv.fr
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a highly targeted intrusion campaign that concealed its final-stage payload by storing encrypted shellcode inside Windows event logs, giving attackers a stealthy way to maintain a **fileless** presence on compromised systems. Observed from September 2021 through at least February 2022, the operation used a multi-stage chain that combined commercial offensive tools including **Cobalt Strike** and **SilentBreak** with custom anti-detection wrappers, **DLL sideloading**, memory injection, and patching of **ETW** and **AMSI** to reduce visibility. The attackers also used signed malware, victim-tailored domain mimicry, and infrastructure hosted with providers including **Linode**, **Namecheap**, and **DreamVPS**. Persistence was established by copying `WerFault.exe` and a malicious `wer.dll` into `C:\Windows\Tasks`, while later-stage RAT variants communicated over **HTTP** or named pipes and supported reconnaissance, command execution, file operations, credential theft, screenshot capture, privilege abuse, and lateral movement. Researchers did not attribute the activity to a known threat actor and provisionally labeled the operation **SilentBreak** because that toolset featured prominently in the campaign.
Aug 14, 2026
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026
Mandiant reported that **DARKSIDE** operated as a ransomware-as-a-service group that combined data theft and file encryption, with affiliates conducting intrusions that moved from initial access to hands-on-keyboard post-exploitation before deploying ransomware. The group’s operations were associated with common enterprise attack tooling and tradecraft designed to blend into Windows environments, helping operators maintain access, move laterally, and prepare victim networks for extortion. The referenced techniques and detections show how that activity can appear on endpoints: adversaries may abuse trusted Microsoft utilities `Regsvcs` and `Regasm` under MITRE ATT&CK **`T1218.009`** to proxy malicious .NET code execution and evade application controls, while post-compromise activity may also surface through **Cobalt Strike** named pipes tied to Beacon, Artifact Kit, and Malleable C2 profiles. Splunk previously published analytics based on Sysmon Event IDs **17** and **18** to identify those pipe patterns, underscoring how defenders can spot the command-and-control and lateral movement behavior often seen in ransomware intrusions linked to groups such as DARKSIDE.
Aug 15, 2026