Active since at least September 2016, Silence APT group's most recent successful campaign was against Bangladesh-based Dutch-Bangla Bank, which lost over $3 million during a string of ATM cash withdrawals over a span of several days.
According to a new report Singapore-based cybersecurity firm Group-IB shared with The Hacker News, the hacking group has significantly expanded their geography in recent months, increased the frequency of their attack campaigns, as well as enhanced its arsenal.
The report also describes the evolution of the Silence hacking group from "young and highly motivated hackers" to one of the most sophisticated advanced persistent threat (APT) group that is now posing threats to banks worldwide.
Silence APT hacking group has updated their unique TTP (tactics, techniques, and procedures) and changed their encryption alphabets, string encryption, and commands for the bot and the main module to evade detection by security tools.
"In addition, the actor has completely rewritten TrueBot loader, the first-stage module, on which the success of the group's entire attack depends. The hackers also started using Ivoke, a fileless loader, and EDA agent, both written in PowerShell," the researchers said.
EDA is a PowerShell agent, designed to control compromised systems by performing tasks through the command shell and tunneling traffic using the DNS protocol, and is based on the Empire and dnscat2 projects.
Once in a victim organization, the group leverages more sophisticated TTPs and deploy additional malware, either TrueBot or a new fileless PowerShell loader called Ivoke, both designed to collect information about an infected system and send it to an intermediate CnC server.
To choose their targets, the group first create an up-to-date "target list" of active email addresses by sending "recon emails," which usually contain a picture or a link without a malicious payload.
"These campaigns were no longer focused just on Russia and former Soviet countries but spread across Asia and Europe. Since our last public report, Silence has sent out more than 170,000 recon emails to banks in Russia, the former Soviet Union, Asia, and Europe," the report reads.
"In November 2018, Silence tried their hand at targeting the Asian market for the first time in their history. In total, Silence sent out about 80,000 emails, with more than half of them targeting Taiwan, Malaysia, and South Korea."
Featuring Silence APT group's latest campaigns—from May 2018 through 1 August 2019—researchers described the increase in damage from their operations and confirmed that the amount of funds stolen by Silence had increased fivefold since its initial stage, estimating the total loss of $4.2 million.
Besides this, Group-IB researchers also suspect that TrueBot (aka Silence.Downloader) and FlawedAmmyy loader have been developed by the same person as both malware were signed with the same digital certificate.
"The growing threat posed by Silence and its rapid global expansion prompted us to make both reports publicly available in order to help cyber security specialists detect and correctly attribute Silence's worldwide attacks at an early stage," the researchers said.
Group-IB researchers did not share the names of the banks targeted by Silence APT but said that the group successfully targeted banks in India (in August 2018), Russia (in February 2019, Russian "IT Bank"), Kyrgyzstan (in May 2019), Russia (in June 2019), and Chile, Ghana, Costa Rica, and Bulgaria (in July 2019).
Group-IB has published more detailed findings about Silence APT in its new report titled, "Silence 2.0: Going Global." You can head on to its report for more information.
