LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G0091: Silence

Silence is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank's Automated Workstation Client, ATMs, and card processing.[1][2]

EnterpriseG0091GroupObject v2.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Silence is an ATT&CK group entry for a financially motivated actor associated with targeting financial institutions and banking systems, including ATMs and card processing environments. For leaders, the value is not just the group name: it highlights a pattern where credential theft, remote access, scripting, lateral movement, tool transfer, and cleanup behaviors can threaten payment operations and banking continuity if monitoring and identity controls are weak.

Executive priority

Prioritize this as a financial-sector resilience and incident-readiness scenario. The ATT&CK relationships point to behaviors that can affect privileged access, remote administration paths, endpoint integrity, and evidence preservation. Executives should ask whether SOC coverage, identity governance, endpoint logging, and incident response playbooks are strong enough around high-value banking, ATM, card-processing, and administrative systems. Because ATT&CK provides no official detection text for this group, local control validation and audit evidence are especially important.

Technical view

Detection and IR teams should validate coverage against the related behaviors rather than relying on the group label. Key ATT&CK-linked areas include LSASS credential access, valid account abuse, RDP use, scheduled tasks, PowerShell, Windows command shell, Visual Basic, JavaScript execution, registry modification, process injection, remote system discovery, ingress tool transfer, external proxy use, file deletion, use of software deployment tools, and use of tools such as Winexe, SDelete, and Empire. The group object has no specified platforms or tactics, so defenders should scope engineering work from the related techniques and their platforms, with particular attention to Windows-heavy administrative and financial operations environments where those related techniques apply.

Likely telemetry

  • Endpoint process creation and command-line telemetry for PowerShell, cmd, scripting engines, scheduled tasks, and suspicious command obfuscation
  • Windows security logs and EDR events for LSASS access, process injection indicators, registry modification, and file deletion
  • Authentication and identity logs for valid account use, privilege changes, abnormal logon patterns, and RDP sessions
  • Remote administration and lateral movement logs, including RDP, Winexe-like remote execution, and software deployment tool activity
  • Network telemetry for external proxy behavior, command-and-control-like connections, and tool ingress from external systems

Detection direction

  • Build detections around behavior chains: credential access followed by RDP or remote execution, tool transfer, scheduled task creation, registry changes, and cleanup is more meaningful than any single event.
  • Tune for administrative false positives because several related items can be legitimate: Winexe-like remote execution, SDelete, software deployment tools, PowerShell, scheduled tasks, and RDP all require baselining of approved operators, systems, and maintenance windows.
  • Validate visibility on high-value financial systems and administrative jump paths, not only general workstations. The official description references banking systems, ATMs, and card processing, so coverage gaps around specialized systems may be material.
  • Include detections for stealth and evidence-reduction behaviors such as command obfuscation, matching legitimate resource names or locations, process injection, and file deletion.
  • Because ATT&CK provides no official detection guidance for Silence, detection engineering should be tested against the mapped techniques and confirmed with local telemetry quality, retention, and response procedures.

Mitigation priorities

  • Start with identity controls: reduce standing privilege, enforce strong authentication for remote access where applicable, monitor valid account use, and review privileged access to banking and administrative systems.
  • Harden remote administration paths, including RDP and software deployment tooling, with access control, segmentation, logging, and change governance.
  • Improve endpoint controls and logging for scripting, scheduled tasks, registry modification, credential access attempts, and suspicious tool execution.
  • Restrict and monitor tool transfer paths and outbound connectivity that could support external proxy or command-and-control communications.
  • Protect evidence and recovery readiness by monitoring destructive cleanup tools such as SDelete and ensuring incident responders have sufficient log retention and endpoint isolation procedures.
Additional notes and limits

Silence is listed with aliases Silence and Whisper Spider. The official description identifies it as financially motivated and focused on financial institutions in several countries, with cited compromise of banking systems. The provided relationships supply the practical defensive map: credential access, execution through scripting and native interfaces, lateral movement, remote administration, collection, command-and-control support, and cleanup. Treat these relationships as validation priorities, not proof of current activity in any environment.

The supplied ATT&CK object has no official detection text, no specified platforms or tactics at the group level, and no procedure-level details in the prompt. This take therefore avoids claims about active exploitation, customer exposure, guaranteed detection, or unsupported platforms. Local architecture, telemetry availability, business processes, and financial-system dependencies are required to determine actual risk and coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Silence

Silence is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank's Automated Workstation Client, ATMs, and card processing.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

28 rows
DomainIDNameRelationship / procedure
EnterpriseT1571Non-Standard Port

Silence has used port 444 when sending data about the system from the client to the server.[3]

EnterpriseT1053.005Scheduled TaskSub-technique

Silence has used scheduled tasks to stage its operation.[1]

EnterpriseT1055Process Injection

Silence has injected a DLL library containing a Trojan into the fwmain32.exe process.[3]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Silence has used HKCU\Software\Microsoft\Windows\CurrentVersion\Run, HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and the Startup folder to establish persistence.[3]

EnterpriseT1059.005Visual BasicSub-technique

Silence has used VBS scripts.[1]

EnterpriseT1112Modify Registry

Silence can create, delete, or modify a specified Registry key or value.[3]

EnterpriseT1021.001Remote Desktop ProtocolSub-technique

Silence has used RDP for lateral movement.[3]

EnterpriseT1125Video Capture

Silence has been observed making videos of victims to observe bank employees day to day activities.[2][3]

EnterpriseT1059.007JavaScriptSub-technique

Silence has used JS scripts.[1]

EnterpriseT1218.001Compiled HTML FileSub-technique

Silence has weaponized CHM files in their phishing campaigns.[1][2][4][3]

EnterpriseT1072Software Deployment Tools

Silence has used RAdmin, a remote software tool used to remotely control workstations and ATMs.[3]

EnterpriseT1113Screen Capture

Silence can capture victim screen activity.[2][3]

EnterpriseT1027.010Command ObfuscationSub-technique

Silence has used environment variable string substitution for obfuscation.[1]

EnterpriseT1569.002Service ExecutionSub-technique

Silence has used Winexe to install a service on the remote system.[2][3]

EnterpriseT1090.002External ProxySub-technique

Silence has used ProxyBot, which allows the attacker to redirect traffic from the current node to the backconnect server via Sock4\Socks5.[3]

EnterpriseT1553.002Code SigningSub-technique

Silence has used a valid certificate to sign their primary loader Silence.Downloader (aka TrueBot).[4]

EnterpriseT1105Ingress Tool Transfer

Silence has downloaded additional modules and malware to victim’s machines.[3]

EnterpriseT1078Valid Accounts

Silence has used compromised credentials to log on to other systems and escalate privileges.[3]

EnterpriseT1018Remote System Discovery

Silence has used Nmap to scan the corporate network, build a network topology, and identify vulnerable hosts.[3]

EnterpriseT1003.001LSASS MemorySub-technique

Silence has used the Farse6.1 utility (based on Mimikatz) to extract credentials from lsass.exe.[3]

EnterpriseT1059.001PowerShellSub-technique

Silence has used PowerShell to download and execute payloads.[1][3]

EnterpriseT1588.002ToolSub-technique

Silence has obtained and modified versions of publicly-available tools like Empire and PsExec.[4] [2]

EnterpriseT1070.004File DeletionSub-technique

Silence has deleted artifacts, including scheduled tasks, communicates files from the C2 and other logs.[1][3]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

Silence has sent emails with malicious DOCX, CHM, LNK and ZIP attachments. [1][2][3]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

Silence has named its backdoor "WINWORD.exe".[3]

EnterpriseT1204.002Malicious FileSub-technique

Silence attempts to get users to launch malicious attachments delivered via spearphishing emails.[1][2][3]

EnterpriseT1059.003Windows Command ShellSub-technique

Silence has used Windows command-line to run commands.[1][2][3]

EnterpriseT1106Native API

Silence has leveraged the Windows API, including using CreateProcess() or ShellExecute(), to perform a variety of tasks.[2][3]

Associated objects

Groups, software, and campaigns

ToolEnterprise

S0363: Empire

Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure PowerShell for Windows and Python for Linux/macOS. Empire was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.[1][2][3]

LinuxmacOSWindows
ToolEnterprise

S0191: Winexe

Winexe is a lightweight, open source tool similar to PsExec designed to allow system administrators to execute commands on remote servers. [1] Winexe is unique in that it is a GNU/Linux based client. [2]

ToolEnterprise

S0195: SDelete

SDelete is an application that securely deletes data in a way that makes it unrecoverable. It is part of the Microsoft Sysinternals suite of tools. [1]

Windows
Relationship explorer

All related ATT&CK context

uses · TechniqueT1571: Non-Standard PortEnterpriseuses · ToolS0363: EmpireEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1055: Process InjectionEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · ToolS0191: WinexeEnterpriseuses · TechniqueT1021.001: Remote Desktop ProtocolEnterpriseuses · TechniqueT1125: Video CaptureEnterpriseuses · TechniqueT1059.007: JavaScriptEnterpriseuses · TechniqueT1218.001: Compiled HTML FileEnterpriseuses · TechniqueT1072: Software Deployment ToolsEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1027.010: Command ObfuscationEnterpriseuses · TechniqueT1569.002: Service ExecutionEnterpriseuses · TechniqueT1090.002: External ProxyEnterpriseuses · TechniqueT1553.002: Code SigningEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1078: Valid AccountsEnterpriseuses · TechniqueT1018: Remote System DiscoveryEnterpriseuses · TechniqueT1003.001: LSASS MemoryEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1588.002: ToolEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.2
Created
Modified
Raw hash
48bf04c1915c20f6...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.2Current bundle48bf04c1915c…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Cyber Forensicator Silence Jan 2019

    Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.

    Open source URL
  2. [2]
    SecureList Silence Nov 2017

    GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.

    Open source URL
  3. [3]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  4. [4]
    Group IB Silence Aug 2019

    Group-IB. (2019, August). Silence 2.0: Going Global. Retrieved May 5, 2020.

    Open source URL
  5. [5]
    Crowdstrike GTR2020 Mar 2020

    Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.

    Open source URL
  6. [6]
    Crowdstrike GTR2020 Mar 2020

    Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.

    Open source URL
  7. [7]
    Crowdstrike GTR2020 Mar 2020

    Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.

    Open source URL
  8. [8]
    Cyber Forensicator Silence Jan 2019

    Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.

    Open source URL
  9. [9]
    Cyber Forensicator Silence Jan 2019

    Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.

    Open source URL
  10. [10]
    SecureList Silence Nov 2017

    GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.

    Open source URL
  11. [11]
    SecureList Silence Nov 2017

    GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.

    Open source URL
  12. [12]
    Silence

    (Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017)

  13. [13]
    Silence

    (Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017)

  14. [14]
    Silence

    (Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017)

  15. [15]
    Whisper Spider

    (Citation: Crowdstrike GTR2020 Mar 2020)

  16. [16]
    Whisper Spider

    (Citation: Crowdstrike GTR2020 Mar 2020)

  17. [17]
    Whisper Spider

    (Citation: Crowdstrike GTR2020 Mar 2020)

  18. [18]
    mitre-attackG0091
    Open source URL
  19. [19]
    mitre-attackG0091
    Open source URL
  20. [20]
    mitre-attackG0091
    Open source URL
  21. [21]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  22. [22]
    Group IB Silence Aug 2019

    Group-IB. (2019, August). Silence 2.0: Going Global. Retrieved May 5, 2020.

    Open source URL
  23. [23]
    Cyber Forensicator Silence Jan 2019

    Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.

    Open source URL
  24. [24]
    Cyber Forensicator Silence Jan 2019

    Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.

    Open source URL
  25. [25]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  26. [26]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  27. [27]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  28. [28]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  29. [29]
    Cyber Forensicator Silence Jan 2019

    Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.

    Open source URL
  30. [30]
    Cyber Forensicator Silence Jan 2019

    Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.

    Open source URL
  31. [31]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  32. [32]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  33. [33]
    SecureList Silence Nov 2017

    GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.

    Open source URL
  34. [34]
    SecureList Silence Nov 2017

    GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.

    Open source URL
  35. [35]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  36. [36]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  37. [37]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  38. [38]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  39. [39]
    SecureList Silence Nov 2017

    GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.

    Open source URL
  40. [40]
    SecureList Silence Nov 2017

    GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.

    Open source URL
  41. [41]
    Cyber Forensicator Silence Jan 2019

    Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.

    Open source URL
  42. [42]
    Cyber Forensicator Silence Jan 2019

    Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.

    Open source URL
  43. [43]
    Cyber Forensicator Silence Jan 2019

    Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.

    Open source URL
  44. [44]
    Cyber Forensicator Silence Jan 2019

    Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.

    Open source URL
  45. [45]
    Group IB Silence Aug 2019

    Group-IB. (2019, August). Silence 2.0: Going Global. Retrieved May 5, 2020.

    Open source URL
  46. [46]
    Group IB Silence Aug 2019

    Group-IB. (2019, August). Silence 2.0: Going Global. Retrieved May 5, 2020.

    Open source URL
  47. [47]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  48. [48]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  49. [49]
    SecureList Silence Nov 2017

    GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.

    Open source URL
  50. [50]
    SecureList Silence Nov 2017

    GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.

    Open source URL
  51. [51]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  52. [52]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  53. [53]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  54. [54]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  55. [55]
    SecureList Silence Nov 2017

    GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.

    Open source URL
  56. [56]
    SecureList Silence Nov 2017

    GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.

    Open source URL
  57. [57]
    Cyber Forensicator Silence Jan 2019

    Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.

    Open source URL
  58. [58]
    Cyber Forensicator Silence Jan 2019

    Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.

    Open source URL
  59. [59]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  60. [60]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  61. [61]
    SecureList Silence Nov 2017

    GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.

    Open source URL
  62. [62]
    SecureList Silence Nov 2017

    GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.

    Open source URL
  63. [63]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  64. [64]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  65. [65]
    Group IB Silence Aug 2019

    Group-IB. (2019, August). Silence 2.0: Going Global. Retrieved May 5, 2020.

    Open source URL
  66. [66]
    Group IB Silence Aug 2019

    Group-IB. (2019, August). Silence 2.0: Going Global. Retrieved May 5, 2020.

    Open source URL
  67. [67]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  68. [68]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  69. [69]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  70. [70]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  71. [71]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  72. [72]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  73. [73]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  74. [74]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  75. [75]
    Cyber Forensicator Silence Jan 2019

    Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.

    Open source URL
  76. [76]
    Cyber Forensicator Silence Jan 2019

    Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.

    Open source URL
  77. [77]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  78. [78]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  79. [79]
    Group IB Silence Aug 2019

    Group-IB. (2019, August). Silence 2.0: Going Global. Retrieved May 5, 2020.

    Open source URL
  80. [80]
    Group IB Silence Aug 2019

    Group-IB. (2019, August). Silence 2.0: Going Global. Retrieved May 5, 2020.

    Open source URL
  81. [81]
    SecureList Silence Nov 2017

    GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.

    Open source URL
  82. [82]
    SecureList Silence Nov 2017

    GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.

    Open source URL
  83. [83]
    Cyber Forensicator Silence Jan 2019

    Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.

    Open source URL
  84. [84]
    Cyber Forensicator Silence Jan 2019

    Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.

    Open source URL
  85. [85]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  86. [86]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  87. [87]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  88. [88]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  89. [89]
    Cyber Forensicator Silence Jan 2019

    Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.

    Open source URL
  90. [90]
    Cyber Forensicator Silence Jan 2019

    Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.

    Open source URL
  91. [91]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  92. [92]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  93. [93]
    SecureList Silence Nov 2017

    GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.

    Open source URL
  94. [94]
    SecureList Silence Nov 2017

    GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.

    Open source URL
  95. [95]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  96. [96]
    Cyber Forensicator Silence Jan 2019

    Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.

    Open source URL
  97. [97]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  98. [98]
    SecureList Silence Nov 2017

    GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.

    Open source URL
  99. [99]
    Cyber Forensicator Silence Jan 2019

    Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.

    Open source URL
  100. [100]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  101. [101]
    SecureList Silence Nov 2017

    GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.

    Open source URL
  102. [102]
    Group IB Silence Sept 2018

    Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.

    Open source URL
  103. [103]
    SecureList Silence Nov 2017

    GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use