Silence

Silence, also known as Whisper Spider, is a financially motivated threat actor. In the provided content, Silence is associated with spearphishing emails carrying malicious DOCX, CHM, LNK, and ZIP attachments and attempts to induce users to launch those attachments. The group has used JavaScript and PowerShell to download and execute payloads, Windows command-line for command execution, and scheduled tasks to stage operations. For persistence, it has used HKCU\Software\Microsoft\Windows\CurrentVersion\Run, HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and the Startup folder, and it can create, delete, or modify Registry keys or values. The actor has used ProxyBot to redirect traffic from an infected node to a backconnect server via SOCKS4/SOCKS5, obtained and modified publicly available tools such as Empire and PsExec, and named its backdoor "WINWORD.exe" as a masquerading measure. The content also states that Silence injected a DLL containing a Trojan into the fwmain32.exe process, deleted artifacts including scheduled tasks, files received from command and control, and logs, used Nmap to scan corporate networks and identify vulnerable hosts, and used RDP or Remote Desktop Services for lateral movement.