Home / Threat actors / Silence
Silence G0091
Also known as: Whisper Spider
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
0
associated CVEs
37
Techniques
3
Malware and tools
Silence is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank's Automated Workstation Client, ATMs, and card processing.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
ATT&CK does not cite CVEs for this group.
Techniques by tactic
Resource Development
T1588.002 Tool Initial Access
T1078 Valid AccountsT1566.001 Spearphishing Attachment Execution
T1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1059.007 JavaScriptT1072 Software Deployment ToolsT1106 Native APIT1204.002 Malicious FileT1569.002 Service Execution Persistence
T1053.005 Scheduled TaskT1078 Valid AccountsT1112 Modify RegistryT1547.001 Registry Run Keys / Startup Folder Privilege Escalation
T1053.005 Scheduled TaskT1055 Process InjectionT1078 Valid AccountsT1547.001 Registry Run Keys / Startup Folder Stealth
T1027.010 Command ObfuscationT1036.005 Match Legitimate Resource Name or LocationT1055 Process InjectionT1070.004 File DeletionT1078 Valid AccountsT1218.001 Compiled HTML File Defense Impairment
T1112 Modify RegistryT1553.002 Code Signing Credential Access
T1003.001 LSASS Memory Discovery
T1018 Remote System Discovery Lateral Movement
T1021.001 Remote Desktop ProtocolT1072 Software Deployment Tools Collection
T1113 Screen CaptureT1125 Video Capture Command and Control
T1090.002 External ProxyT1105 Ingress Tool TransferT1571 Non-Standard Port © The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.