Silence

Silence, also tracked as Whisper Spider and Silence Group, is a financially motivated cybercrime intrusion set known primarily for targeting banks and other financial institutions. The group has been active in the cybercrime ecosystem and has been associated with operations against banking organizations in Russia, Armenia, and Malaysia. Its tradecraft overlaps in part with other financially motivated bank-focused actors, including use of spearphishing to gain initial access and modular malware to expand capability after compromise. Silence commonly relies on spearphishing emails carrying malicious attachments, including document, archive, shortcut, and compiled help file formats, to induce user execution. After initial compromise, the group has used PowerShell, JavaScript, VBScript, Windows command-line execution, and native Windows API functionality to launch payloads and perform follow-on actions. It has also downloaded additional modules and malware to victim systems, indicating a staged and modular intrusion workflow. For persistence, Silence has used scheduled tasks as well as Registry Run keys and Startup-folder mechanisms. The group has modified Registry values and used Windows autostart extensibility points to survive reboots and maintain access. It has also employed masquerading, including naming a backdoor to resemble a legitimate Microsoft Office process, to reduce suspicion. Screen capture capability has been observed in its tooling, supporting operator surveillance and victim-environment awareness. Silence has also deleted artifacts such as scheduled tasks, transferred files, and logs to hinder forensic reconstruction and cover tracks. Overall, Silence is best characterized as a bank-focused cybercrime actor with capabilities spanning initial access, persistence, execution, payload staging, surveillance, and defense evasion.