Silence

Silence, also known as Silence Group and Whisper Spider, is a Russia-based, financially motivated cybercriminal group targeting financial institutions. Its targets include organizations in Russia, Kazakhstan, Ukraine, Azerbaijan, and Poland, with additional targeting across other regions. The group was prominent in attacks against financial institutions during the late 2010s. Silence uses spearphishing emails with malicious Word documents, compiled HTML files, Windows shortcuts, and ZIP archives to deliver payloads. Following compromise, it uses Nmap to map corporate networks and identify vulnerable hosts. It extracts credentials from Windows Local Security Authority process memory using Farse6.1, a Mimikatz-based utility, and abuses compromised accounts to access additional systems and escalate privileges. Remote Desktop Protocol supports lateral movement. Its operations also involve Windows command-shell execution, scheduled tasks for operational staging, DLL injection into running processes, and environment-variable string substitution to obfuscate commands. Silence obtains and modifies publicly available tools, including Empire and PsExec. Silence developed Truebot, a first-stage downloader capable of collecting system information and taking screenshots. Truebot has also appeared in operations attributed to other criminal groups; its presence alone does not establish Silence attribution.