Cyber Threat Actor: Silent

On April 1, 2025, Versa Networks publicly disclosed a cybersecurity incident that had affected a non‑production environment used for limited quality‑assurance testing, validation sandboxes and development workspaces, emphasizing that no customer or employee data were present in the compromised system. The company stated that it had immediately launched an investigation, successfully expelled the intruder responsible for the breach, and blocked any further unauthorized activity from occurring. Versa Networks’ internal inquiry concluded that the compromise remained confined to that environment and did not extend to production systems or any associated data, thereby limiting the potential impact of the event. The disclosure was accompanied by references to external reporting platforms, including RansomLook.io, which linked the activity to a specific threat actor. According to those reports, the intrusion was carried out by an individual or group associated with the extortion outfit known as Silent. Versa Networks noted that the incident was handled swiftly and that the containment measures prevented any leakage of sensitive information.

Silent is publicly described as a spin‑off of the earlier threat cluster Hunters International, positioning it as an offshoot that inherited certain operational characteristics while establishing its own identity. The group is characterized in open sources as an extortion organization. A Silent administrator, communicating through the group’s leak site, warned that large information technology firms would soon be listed on the site and would be compelled to reconsider their stance on paying ransom demands. This warning indicates that Silent intends to broaden its target base beyond the initial victim. The Versa Networks incident therefore serves as a concrete example of the group’s capability to infiltrate corporate environments, even when those environments are segregated from production assets, and to communicate its intentions through public channels. No further details about Silent’s internal structure, geographic focus, or specific malware families have been made available in the public reporting surrounding this event.