actively-exploited-vulnerabilityinternet-facing-service-vulnerabilitydata-exfiltration-methodpersistence-method

Silent Skimmer-Linked Attackers Exploit Telerik Flaws to Steal Payment Data

Active Exploitation · 2 sources · Updated 18d ago · First seen Nov 7, 2024

Attackers compromised multiple web servers at a North America-headquartered multinational organization in late May 2024, exploiting older Telerik UI vulnerabilities to access payment information. Palo Alto Networks Unit 42 tracks the activity as CL-CRI-0941 and assesses that overlaps in infrastructure, tooling and techniques suggest a connection to the financially motivated actor behind Silent Skimmer. Unlike the previously reported campaign, which scraped payment pages, this intrusion used a compiled Python script with hard-coded database credentials to dump payment information into a CSV file for exfiltration.

The attackers deployed web shells and reverse shells, used privilege-escalation and reverse-proxy tools to maintain access, and employed the RingQ loader and Cobalt Strike. Their toolkit also included mixed-mode .NET binaries containing native C++ code—a format Microsoft documents as combining native and managed code within an assembly. Defenders should prioritize remediation of vulnerable Telerik UI deployments, investigate unexpected shells and proxy tools on web servers, and review payment-database access, embedded credentials and unusual CSV exports rather than limiting detection to payment-page tampering.

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

7 events · Sep 2023 – May 2024

Reported Nov 7, 20242y ago
Unit 42 links CL-CRI-0941 to Silent Skimmer and publishes detection guidance
Unit 42 designated the activity CL-CRI-0941 and identified infrastructure, tooling, and technique overlaps suggesting a connection to Silent Skimmer, without establishing definitive attribution. Its report disclosed the database-dumping technique and provided detection queries for suspicious MSHTA activity and IIS processes dropping exploit-associated DLLs.
Silent Skimmer Gets Loud (Again)
Reported Nov 7, 20242y ago
Attackers dump payment information directly from the victim's database
After obtaining web shell access, the attackers wrote a Windows executable disguised with a .txt extension to disk. The executable contained a PyInstaller-packaged Python script that used hard-coded database credentials to dump payment information into a CSV file for exfiltration.
Silent Skimmer Gets Loud (Again)
Reported Nov 7, 20242y ago
Attackers deploy mixed-mode binaries, RingQ, and Cobalt Strike
The intrusion used mixed-mode .NET binaries containing native C++ code that invoked MSHTA to execute remote HTA payloads. The attackers also deployed the RingQ loader for encrypted payload loading and Cobalt Strike for post-exploitation.
Silent Skimmer Gets Loud (Again)
Reported Nov 7, 20242y ago
Attackers escalate privileges and add a Windows Defender exclusion
The attackers used GodPotato for privilege escalation, launching it through Base64-encoded PowerShell and retrieving additional payloads from remote infrastructure. They also used PowerShell to add the D:\ drive to Windows Defender's exclusion list.
Silent Skimmer Gets Loud (Again)
Reported Nov 7, 20242y ago
Attackers deploy web shells, reverse shells, and tunneling tools
The attackers uploaded web shells and deployed reverse shells, including MSHTA-delivered HTA scripts that launched encoded PowerShell. They used Fuso and FRP to expose compromised servers behind firewalls or network address translation and maintain access.
Silent Skimmer Gets Loud (Again)
May 2024
Attackers compromise multiple web servers at a multinational organization
In late May 2024, attackers compromised multiple web servers belonging to a multinational organization headquartered in North America. Unit 42 investigated the intrusion, which included attempts to exploit Telerik UI vulnerabilities CVE-2017-11317 and CVE-2019-18935.
Silent Skimmer Gets Loud (Again)
Sep 2023
BlackBerry first reports the Silent Skimmer campaign
BlackBerry first reported Silent Skimmer, a financially motivated campaign that extracted payment data by modifying payment-related pages. Its techniques included Telerik exploitation, web shells, MSHTA-based reverse shells, reverse proxies, GodPotato, and Cobalt Strike.
Silent Skimmer Gets Loud (Again)

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Vulnerabilities

2 linked

Remote Code Execution in Progress Telerik UI for ASP.NET AJAX RadAsyncUpload (CVE-2019-18935)Arbitrary File Upload via Hardcoded Keys in Telerik RadAsyncUpload (CVE-2017-11317)

Threat actors

1 linked

CL-CRI-0941

Affected products

1 linked

Telerik Ui

Observables

5 linked

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Palo Alto Networks Unit 42 BlogNews · Nov 7, 2024

Silent Skimmer Gets Loud (Again)Open source ↗

Learn MicrosoftNews

Mixed (Native and Managed) Assemblies | Microsoft LearnOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News