File · SilverTerrier · Unknown · assessed origin Nigeria · misp-galaxy + mitre-attack · refreshed 2026-10-06

SilverTerrier

attack rose · 4 techniques across 2 tactics

Analyst brief

misp-galaxy + mitre-attack

As these tools rise and fall in popularity (and more importantly, as detection rates by antivirus vendors improve), SilverTerrier actors have consistently adopted new malware families and shifted to the latest packing tools available.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

4 techniques · 2 of 15 tactics

Matters for

Command and control
3 techniques
Impact
1 technique

select a technique

Arsenal

5 malware

Malware
Malware · 5	ATT&CK	Shared by
NanoCore	S0336 ↗	4 actors
Agent Tesla	S0331 ↗	2 actors
NETWIRE	S0198 ↗	4 actors
DarkComet	S0334 ↗	2 actors
Lokibot	S0447 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

3 sources

Track SilverTerrier on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.