Silence is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank's Automated Workstation Client, ATMs, and card processing.12
- Cyber Forensicator Silence Jan 2019
- SecureList Silence Nov 2017
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1571 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1112 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1125 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.007 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1072 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1113 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1569.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1106 | 2019 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1018 | Remote System Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1027.010 | Command Obfuscation | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1053.005 | Scheduled Task | — |
| T1055 | Process Injection | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.005 | Visual Basic | — |
| T1059.007 | JavaScript | — |
| T1070.004 | File Deletion | — |
| T1072 | Software Deployment Tools | — |
| T1078 | Valid Accounts | — |
| T1090.002 | External Proxy | — |
| T1105 | Ingress Tool Transfer | — |
| T1106 | Native API | — |
| T1112 | Modify Registry | — |
| T1113 | Screen Capture | — |
| T1125 | Video Capture | — |
| T1204.002 | Malicious File | — |
| T1218.001 | Compiled HTML File | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1553.002 | Code Signing | — |
| T1566.001 | Spearphishing Attachment | — |
| T1569.002 | Service Execution | — |
| T1571 | Non-Standard Port | — |
| T1588.002 | Tool | — |
Aliases
Silence · Whisper Spider
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.