Watch Floor
CybercrimeMITRE G0091

Silence group

Also known as Silence, WHISPER SPIDER

0mentions, 7 days
1mentions, 30 days
Oct 29, 2026last mentioned

a relatively new threat actor that’s been operating since mid-2016 Group-IB has exposed the attacks committed by Silence cybercriminal group. While the gang had previously targeted Russian banks, Group-IB experts also have discovered evidence of the group's activity in more than 25 countries worldwide. Group-IB has published its first detailed report on tactics and tools employed by Silence. Group-IB security analysts' hypothesis is that at least one of the gang members appears to be a former or current employee of a cyber security company. The confirmed damage from Silence activity is estimated at 800 000 USD. Silence is a group of Russian-speaking hackers, based on their commands language, the location of infrastructure they used, and the geography of their targets (Russia, Ukraine, Belarus, Azerbaijan, Poland, and Kazakhstan). Although phishing emails were also sent to bank employees in Central and Western Europe, Africa, and Asia). Furthermore, Silence used Russian words typed on an English keyboard layout for the commands of the employed backdoor. The hackers also used Russian-language web hosting services.

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1003.001 LSASS MemoryT1018 Remote System DiscoveryT1021.001 Remote Desktop ProtocolT1027.010 Command ObfuscationT1036.005 Match Legitimate Resource Name or LocationT1053.005 Scheduled TaskT1055 Process InjectionT1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1059.007 JavaScriptT1070.004 File DeletionT1072 Software Deployment ToolsT1078 Valid AccountsT1090.002 External ProxyT1105 Ingress Tool TransferT1106 Native APIT1112 Modify RegistryT1113 Screen CaptureT1125 Video CaptureT1204.002 Malicious FileT1218.001 Compiled HTML FileT1547.001 Registry Run Keys / Startup FolderT1553.002 Code SigningT1566.001 Spearphishing AttachmentT1569.002 Service ExecutionT1571 Non-Standard PortT1588.002 Tool

Recent activity

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.