Silence
- ID
- G0091
- Associated names
- Whisper Spider
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Silence is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank's Automated Workstation Client, ATMs, and card processing.[1][2]
Techniques used (28)
- T1003.001 LSASS Memory
- T1018 Remote System Discovery
- T1021.001 Remote Desktop Protocol
- T1027.010 Command Obfuscation
- T1036.005 Match Legitimate Resource Name or Location
- T1053.005 Scheduled Task
- T1055 Process Injection
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1059.007 JavaScript
- T1070.004 File Deletion
- T1072 Software Deployment Tools
- T1078 Valid Accounts
- T1090.002 External Proxy
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1112 Modify Registry
- T1113 Screen Capture
- T1125 Video Capture
- T1204.002 Malicious File
- T1218.001 Compiled HTML File
- T1547.001 Registry Run Keys / Startup Folder
- T1553.002 Code Signing
- T1566.001 Spearphishing Attachment
- T1569.002 Service Execution
- T1571 Non-Standard Port
- T1588.002 Tool