File · Silence group · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06
attack rose · 28 techniques across 11 tactics
Analyst brief
misp-galaxy + mitre-attacka relatively new threat actor that’s been operating since mid-2016 Group-IB has exposed the attacks committed by Silence cybercriminal group. While the gang had previously targeted Russian banks, Group-IB experts also have discovered evidence of the group's activity in more than 25 countries worldwide. Group-IB has published its first detailed report on tactics and tools employed by Silence.
Group-IB security analysts' hypothesis is that at least one of the gang members appears to be a former or current employee of a cyber security company. The confirmed damage from Silence activity is estimated at 800 000 USD. Silence is a group of Russian-speaking hackers, based on their commands language, the location of infrastructure they used, and the geography of their targets (Russia, Ukraine, Belarus, Azerbaijan, Poland, and Kazakhstan).
Although phishing emails were also sent to bank employees in Central and Western Europe, Africa, and Asia). Furthermore, Silence used Russian words typed on an English keyboard layout for the commands of the employed backdoor. The hackers also used Russian-language web hosting services.
Kill chain
MITRE ATT&CK Enterprise · tap a technique28 techniques · 11 of 15 tactics
Resource development
1 techniqueInitial access
1 techniqueExecution
9 techniquesPersistence
1 techniqueStealth
6 techniquesDefense impairment
2 techniquesCredential access
1 techniqueDiscovery
1 techniqueLateral movement
1 techniqueCollection
2 techniquesCommand and control
3 techniques
select a technique
Arsenal
3 toolsas stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
Take it with you
keyless · no signupReferences
6 sourcesTrack Silence group on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.