G0091: Silence

G0091: Silence describes [Silence](https://attack.mitre.org/groups/G0091) is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank's Automated Workstation Client, ATMs, and card processing.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017)

Executive priority

G0091: Silence is an official MITRE ATT&CK group. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate G0091: Silence by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata

Detection direction

Validate whether G0091: Silence appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Silence

Silence is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank's Automated Workstation Client, ATMs, and card processing.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques28 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1571	Non-Standard Port	Silence has used port 444 when sending data about the system from the client to the server.CitationGroup IB Silence Sept 2018
Enterprise	T1053.005	Scheduled TaskSub-technique	Silence has used scheduled tasks to stage its operation.[1]
Enterprise	T1055	Process Injection	Silence has injected a DLL library containing a Trojan into the fwmain32.exe process.CitationGroup IB Silence Sept 2018
Enterprise	T1547.001	Registry Run Keys / Startup FolderSub-technique	Silence has used `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, `HKLM\Software\Microsoft\Windows\CurrentVersion\Run`, and the Startup folder to establish persistence.CitationGroup IB Silence Sept 2018
Enterprise	T1059.005	Visual BasicSub-technique	Silence has used VBS scripts.[1]
Enterprise	T1112	Modify Registry	Silence can create, delete, or modify a specified Registry key or value.CitationGroup IB Silence Sept 2018
Enterprise	T1021.001	Remote Desktop ProtocolSub-technique	Silence has used RDP for lateral movement.CitationGroup IB Silence Sept 2018
Enterprise	T1125	Video Capture	Silence has been observed making videos of victims to observe bank employees day to day activities.[2]CitationGroup IB Silence Sept 2018
Enterprise	T1059.007	JavaScriptSub-technique	Silence has used JS scripts.[1]
Enterprise	T1218.001	Compiled HTML FileSub-technique	Silence has weaponized CHM files in their phishing campaigns.[1][2]CitationGroup IB Silence Aug 2019CitationGroup IB Silence Sept 2018
Enterprise	T1072	Software Deployment Tools	Silence has used RAdmin, a remote software tool used to remotely control workstations and ATMs.CitationGroup IB Silence Sept 2018
Enterprise	T1113	Screen Capture	Silence can capture victim screen activity.[2]CitationGroup IB Silence Sept 2018
Enterprise	T1027.010	Command ObfuscationSub-technique	Silence has used environment variable string substitution for obfuscation.[1]
Enterprise	T1569.002	Service ExecutionSub-technique	Silence has used Winexe to install a service on the remote system.[2]CitationGroup IB Silence Sept 2018
Enterprise	T1090.002	External ProxySub-technique	Silence has used ProxyBot, which allows the attacker to redirect traffic from the current node to the backconnect server via Sock4\Socks5.CitationGroup IB Silence Sept 2018
Enterprise	T1553.002	Code SigningSub-technique	Silence has used a valid certificate to sign their primary loader Silence.Downloader (aka TrueBot).CitationGroup IB Silence Aug 2019
Enterprise	T1105	Ingress Tool Transfer	Silence has downloaded additional modules and malware to victim’s machines.CitationGroup IB Silence Sept 2018
Enterprise	T1078	Valid Accounts	Silence has used compromised credentials to log on to other systems and escalate privileges.CitationGroup IB Silence Sept 2018
Enterprise	T1018	Remote System Discovery	Silence has used Nmap to scan the corporate network, build a network topology, and identify vulnerable hosts.CitationGroup IB Silence Sept 2018
Enterprise	T1003.001	LSASS MemorySub-technique	Silence has used the Farse6.1 utility (based on Mimikatz) to extract credentials from lsass.exe.CitationGroup IB Silence Sept 2018
Enterprise	T1059.001	PowerShellSub-technique	Silence has used PowerShell to download and execute payloads.[1]CitationGroup IB Silence Sept 2018
Enterprise	T1588.002	ToolSub-technique	Silence has obtained and modified versions of publicly-available tools like Empire and PsExec.CitationGroup IB Silence Aug 2019 [2]
Enterprise	T1070.004	File DeletionSub-technique	Silence has deleted artifacts, including scheduled tasks, communicates files from the C2 and other logs.[1]CitationGroup IB Silence Sept 2018
Enterprise	T1566.001	Spearphishing AttachmentSub-technique	Silence has sent emails with malicious DOCX, CHM, LNK and ZIP attachments. [1][2]CitationGroup IB Silence Sept 2018
Enterprise	T1036.005	Match Legitimate Resource Name or LocationSub-technique	Silence has named its backdoor "WINWORD.exe".CitationGroup IB Silence Sept 2018
Enterprise	T1204.002	Malicious FileSub-technique	Silence attempts to get users to launch malicious attachments delivered via spearphishing emails.[1][2]CitationGroup IB Silence Sept 2018
Enterprise	T1059.003	Windows Command ShellSub-technique	Silence has used Windows command-line to run commands.[1][2]CitationGroup IB Silence Sept 2018
Enterprise	T1106	Native API	Silence has leveraged the Windows API, including using CreateProcess() or ShellExecute(), to perform a variety of tasks.[2]CitationGroup IB Silence Sept 2018

Associated objects

Groups, software, and campaigns

S0363: Empire

Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure PowerShell for Windows and Python for Linux/macOS. Empire was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.[1][2][3]

LinuxmacOSWindows

S0191: Winexe

Winexe is a lightweight, open source tool similar to PsExec designed to allow system administrators to execute commands on remote servers. [1] Winexe is unique in that it is a GNU/Linux based client. [2]

S0195: SDelete

SDelete is an application that securely deletes data in a way that makes it unrecoverable. It is part of the Microsoft Sysinternals suite of tools. [1]

Windows

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 2.2
Created: May 24, 2019, 17:57 UTC (UTC+00:00)
Modified: Jul 31, 2026, 18:48 UTC (UTC+00:00)
Raw hash: 8cf0bdd5f78feb29...

Imported snapshots across ATT&CK releases(2)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	2.2	Jul 31, 2026, 18:48 UTC (UTC+00:00)	Current bundle	`8cf0bdd5f78f…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	2.2	Nov 17, 2024, 18:19 UTC (UTC+00:00)	Older bundle	`48bf04c1915c…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Cyber Forensicator Silence Jan 2019
Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.
Open source URL
[2]
SecureList Silence Nov 2017
GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.
Open source URL
[3]
Crowdstrike GTR2020 Mar 2020
Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.
Open source URL
[4]
Silence
(Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017)
[5]
Whisper Spider
(Citation: Crowdstrike GTR2020 Mar 2020)
[6]
mitre-attackG0091
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use