Loading malware…
SilentNight is a Windows malware family widely described as a variant of Zloader and sold on Russian-speaking underground forums since late 2019. It has been characterized as a C/C++ backdoor or trojan with modular functionality and has been used by multiple financially motivated threat actors rather than being exclusive to a single cluster. SilentNight communicates over HTTP and HTTPS for command and control and may use a domain generation algorithm to support resilient infrastructure. Reported capabilities include remote system control, screenshot capture, keylogging, file management, browser-focused credential targeting, and access to cryptocurrency wallets.
SilentNight has been observed as a second-stage payload delivered by Emotet since 2020, placing it within broader criminal malware delivery ecosystems that also distribute banking trojans, loaders, information stealers, and ransomware-enabling tooling. It has also appeared in intrusion chains associated with ransomware operations, including activity linked to Ryuk distribution, and has been noted as an alternative access malware used by operators associated with Black Basta after disruption of QakBot infrastructure. In those contexts, SilentNight functions as an access-enabling backdoor that supports follow-on reconnaissance, credential theft, and post-compromise operations.
Recent reporting associates SilentNight intrusions with malvertising-driven delivery in addition to earlier phishing-linked access patterns seen in adjacent campaigns. Its role in financially motivated intrusions, underground availability, and overlap with major loader and ransomware ecosystems make it relevant as both a standalone backdoor and an initial foothold for downstream extortion activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
SilentNight est un cheval de Troie vendu sur des forums russophones souterrains depuis fin 2019. Il est une variante du code malveillante Zloader.
SILENTNIGHT is a C/C++ backdoor that communicates via HTTP/HTTPS and may utilize a domain generation algorithm (DGA) for C2. Its plug-in framework allows for versatile functionality, including system control, screenshot capture, keylogging, file management, and cryptocurrency wallet access.
SILENTNIGHT is a C/C++ backdoor that communicates via HTTP/HTTPS and may utilize a domain generation algorithm (DGA) for C2. Its plug-in framework allows for versatile functionality, including system control, screenshot capture, keylogging, file management, and cryptocurrency wallet access.
The threat cluster relies heavily on Remote Monitoring and Management (RMM) tools, unlike UNC2686 which deployed BAZARLOADER variants as well as TRICKBOT, URSNIF, and SILENTNIGHT.
8 distinct techniques documented for this family, organized by ATT&CK tactic.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Alternative malware referenced as being used for initial access after QakBot disruption.
Trojan sold on Russian-speaking underground forums (since late 2019) observed in phishing-driven campaigns associated with Ryuk distribution; described as a variant of Zloader.
Trojan and Zloader variant distributed by Emotet as a second payload since 2020.
Trojan sold on underground forums and distributed by Emotet as a second-stage payload since 2020; described as a variant of Zloader.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.