Silence

Silence has used HKCU\Software\Microsoft\Windows\CurrentVersion\Run, HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and the Startup folder to establish persistence.^[4]

Silence has used PowerShell to download and execute payloads.^[1][4]

Silence has deleted artifacts, including scheduled tasks, communicates files from the C2 and other logs.^[1][4]

Silence has named its backdoor "WINWORD.exe".^[4]

Silence has used environment variable string substitution for obfuscation.^[1]

Silence has obtained and modified versions of publicly-available tools like Empire and PsExec.^{[5] [2]}

Silence has used the Farse6.1 utility (based on Mimikatz) to extract credentials from lsass.exe.^[4]

Silence has sent emails with malicious DOCX, CHM, LNK and ZIP attachments. ^[1][2][4]

Silence has used ProxyBot, which allows the attacker to redirect traffic from the current node to the backconnect server via Sock4\Socks5.^[4]

Silence has used RDP for lateral movement.^[4]

Silence has used scheduled tasks to stage its operation.^[1]

Silence has used a valid certificate to sign their primary loader Silence.Downloader (aka TrueBot).^[5]

Silence has weaponized CHM files in their phishing campaigns.^[1][2][5][4]

Silence has used Winexe to install a service on the remote system.^[2][4]

Silence attempts to get users to launch malicious attachments delivered via spearphishing emails.^[1][2][4]