Cyber Threat Actor: Silence Group

TA456, publicly identified as Silence, is a financially motivated cybercriminal group first documented in 2016. The group is associated with Russian-speaking individuals and has primarily targeted financial institutions, initially focusing on Russian entities before expanding internationally. Public reporting attributes the aliases Silence Group and references malware variants such as Silence.Downloader (TrueBot), Silence.MainModule, and Silence.ProxyBot to their operations. Their strategic objective centers on monetary theft through ATM jackpotting and transaction manipulation, as evidenced by campaigns against banks in Russia and Bangladesh. Group-IB’s analysis indicates the group maintains a core of actors with familiarity in legitimate security practices, though no explicit state affiliation or criminal consortium ties are disclosed in available reporting.

Silence employs malware designed for remote command execution, file exfiltration, and traffic redirection. In the 2019 Bangladesh Bank heist targeting Dutch Bangla Bank Limited (DBBL), they utilized Silence.Downloader to deploy malicious modules and Silence.ProxyBot to route traffic through compromised systems. Their infrastructure included a command-and-control server at 103.11.138.198, communicating with victim networks for months prior to theft execution. The group compromised ATM networks via two primary methods: deploying the Atmosphere toolkit for direct cash dispensation or manipulating card processing systems to alter withdrawal limits. These tactics align with earlier operations against the Russian Central Bank’s systems in 2016. For the DBBL attack, Silence coordinated with Ukrainian money mules who physically collected dispensed cash, a scheme interrupted by law enforcement arrests. Forensic evidence, including malware hashes (e.g., Silence.MainModule MD5: fd133e977471a76de8a22ccb0d9815b2) and infrastructure overlaps, solidified attribution of this campaign to the group. This operation marked Silence’s transition beyond Russian borders, demonstrating adaptability in targeting international financial entities.