Silence

Silence, also referred to as Whisper Spider, is a financially motivated threat actor associated in the provided content with intrusions against banks and bank employees. The content states that Silence attempts to get users to launch malicious attachments delivered via spearphishing emails, including DOCX, CHM, LNK, and ZIP files. It has been observed making videos of victims to monitor bank employees’ day-to-day activities. The group’s tradecraft in the provided content includes use of PowerShell to download and execute payloads; use of JavaScript scripts; and use of the Windows command line to run commands. Silence has used scheduled tasks to stage operations and has established persistence via HKCU\Software\Microsoft\Windows\CurrentVersion\Run, HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and the Startup folder. The content also states that Silence can create, delete, or modify Registry keys or values. For command and control and network operations, the content states that Silence used ProxyBot to redirect traffic from the current node to a backconnect server via SOCKS4/SOCKS5, and that it used Nmap to scan corporate networks, build network topology, and identify vulnerable hosts. The group is also noted as using RDP for lateral movement. The content further states that Silence deleted artifacts including scheduled tasks, files received from command and control, and logs; obtained and modified publicly available tools such as Empire and PsExec; and named its backdoor "WINWORD.exe."