Overview 50 indicators
Silence is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank's Automated Workstation Client, ATMs, and card processing.
| domain | 48 | G0091-domain.txt |
| ipv4 | 1 | G0091.json |
| url | 1 | G0091.json |
Techniques 28 ATT&CK
Open in ATT&CK Navigator → or download the layer (28 techniques, layer 4.5)
- T1003.001 LSASS Memory
- T1018 Remote System Discovery
- T1021.001 Remote Desktop Protocol
- T1027.010 Command Obfuscation
- T1036.005 Match Legitimate Resource Name or Location
- T1053.005 Scheduled Task
- T1055 Process Injection
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1059.007 JavaScript
- T1070.004 File Deletion
- T1072 Software Deployment Tools
- T1078 Valid Accounts
- T1090.002 External Proxy
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1112 Modify Registry
- T1113 Screen Capture
- T1125 Video Capture
- T1204.002 Malicious File
- T1218.001 Compiled HTML File
- T1547.001 Registry Run Keys / Startup Folder
- T1553.002 Code Signing
- T1566.001 Spearphishing Attachment
- T1569.002 Service Execution
- T1571 Non-Standard Port
- T1588.002 Tool
Software 3
Principal sources 7 reports
Ranked by how many of this actor's indicators each report brought in.
- 38virustotal.com/gui/ip-address/193.232.180.65/relations
- 10group-ib.com/resources/threat-research/silence_2.0.g…
- 10otx.alienvault.com/pulse/5d5d6e09e5809a8cb83bcea1
- 2twitter.com/Bank_Security/status/1148120505838424065
- 2group-ib.com/media/silence-apt
- 2virustotal.com/gui/file/3b84b2948b95c291986b793e1d8e93…
- 2virustotal.com/gui/file/d2134c83bd8fa18306ad6ca0a8fa08…
Related groups 3
What the sources have in common — not a claim that these are the same actor. See the whole graph.
Timeline 50 indicators
Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.
No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.
-
twitter.com/Bank_Security/status/1148120505838424065 · group-ib.com/media/silence-apt · virustotal.com/gui/file/3b84b2948b95c291986b793e1d8e93… · virustotal.com/gui/file/d2134c83bd8fa18306ad6ca0a8fa08…
ipv4 185.20.187.89:443 url http://185.20.187.89 -
virustotal.com/gui/ip-address/193.232.180.65/relations
1bmank.ru 1m-lombard.ru 1m6ank.ru 1mbabk.ru 1mbakn.ru 1mbamk.ru 1mbanc.ru 1mbanck.ru 1mbang.ru 1mbanj.ru 1mbank.biz 1mbank.info 1mbank.me 1mbank.net 1mbank.online 1mbank.su 1mbankru.ru 1mbanl.ru 1mbnak.ru 1mbonk.ru 1mbsnk.ru 1mbunk.ru 1mcredit.ru 1mliked.ru 1mnank.ru 1mvank.ru 1mvklad.ru 1nnbank.ru abp.ru maybank.ru morefin.ru odinmbank.ru onembank.ru xn--1---7cdbdjx3ajbffshlvpuz.xn--p1ai xn--1--8kcadhu0aibfergltoty.xn--p1ai xn--1-8sbc1bhi.xn--p1ai xn--1-8sbydbel6b.xn--p1ai xn--80absjpcg.com -
group-ib.com/resources/threat-research/silence_2.0.g… · otx.alienvault.com/pulse/5d5d6e09e5809a8cb83bcea1
bankrebres.ru basch.eu cardisprom.ru counterstat.club counterstat.pw fpbank.ru itablex.com mobilecommerzbank.com pharmk.group zaometallniva.ru
Further reading 11
- attack.mitre.org/groups/G0091
- go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdSt…
- securelist.com/the-silence/83009
- web.archive.org/web/20220119133748/https://cyberforensi…
- twitter.com/Bank_Security/status/1148120505838424065
- group-ib.com/resources/threat-research/silence_2.0.g…
- group-ib.com/media/silence-apt
- virustotal.com/gui/file/3b84b2948b95c291986b793e1d8e93…
- virustotal.com/gui/ip-address/193.232.180.65/relations
- otx.alienvault.com/pulse/5d5d6e09e5809a8cb83bcea1
- virustotal.com/gui/file/d2134c83bd8fa18306ad6ca0a8fa08…