Silence

Overview

Silence is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank's Automated Workstation Client, ATMs, and card processing.

Naming & attribution

Silence is tracked under 2 names across the industry. It uses 28 documented ATT&CK techniques — more than 62% of the 174 groups tracked here.

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• FIN6 — 16 shared techniques (31% overlap)
• Cobalt Group — 14 shared techniques (29% overlap)
• Gorgon Group Pakistan — 10 shared techniques (29% overlap)
• Patchwork — 15 shared techniques (28% overlap)
• FIN8 — 14 shared techniques (28% overlap)
• APT39 Iran — 17 shared techniques (27% overlap)

TTPs — 28 techniques across 11 tactics

Tools & malware (3)

Empire · Winexe · SDelete

Reporting (3)

• 2020 Global Threat Report — Crowdstrike
• Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis — Skulkin, O.
• Silence – a new Trojan attacking financial organizations — GReAT