Russian Hacking Group Targeting Banks Worldwide With Evolving Tactics

Silence APT, a Russian-speaking cybercriminal group,
known for targeting financial organizations primarily in former
Soviet states and neighboring countries is now aggressively
targeting banks in more than 30 countries across America, Europe,
Africa, and Asia.

Active since at least September 2016, Silence APT group’s most
recent successful campaign was against Bangladesh-based
Dutch-Bangla Bank, which lost over $3
million^[1] during a string of ATM
cash withdrawals over a span of several days.

According to a new report Singapore-based cybersecurity firm
Group-IB shared with The Hacker News, the hacking group has
significantly expanded their geography in recent months, increased
the frequency of their attack campaigns, as well as enhanced its
arsenal.

The report also
describes the evolution of the Silence hacking group from “young
and highly motivated hackers” to one of the most sophisticated
advanced persistent threat (APT) group that is now posing threats
to banks worldwide.
^[2]

Silence APT hacking group has updated their unique TTP (tactics,
techniques, and procedures) and changed their encryption alphabets,
string encryption, and commands for the bot and the main module to
evade detection by security tools.

EDA is a PowerShell agent, designed to control compromised systems
by performing tasks through the command shell and tunneling traffic
using the DNS protocol, and is based on the Empire and dnscat2
projects.

Just like most hacking groups, Silence gang also relies on
spear-phishing emails with macros Docs or exploits, CHM files, and
.LNK shortcuts as malicious attachments to initially compromise
their victims.

Once in a victim organization, the group leverages more
sophisticated TTPs and deploy additional malware, either TrueBot or
a new fileless PowerShell loader called Ivoke, both designed to
collect information about an infected system and send it to an
intermediate CnC server.

To choose their targets, the group first create an up-to-date
“target list” of active email addresses by sending “recon emails,”
which usually contain a picture or a link without a malicious
payload.

Featuring Silence APT group’s latest campaigns—from May 2018
through 1 August 2019—researchers described the increase in damage
from their operations and confirmed that the amount of funds stolen
by Silence had increased fivefold since its initial stage,
estimating the total loss of $4.2 million.
Besides this, Group-IB researchers also suspect that TrueBot (aka
Silence.Downloader) and FlawedAmmyy loader have been developed by
the same person as both malware were signed with the same digital
certificate.

FlawedAmmyy loader is a remote access Trojan (RAT) associated
with TA505, a separate Russian-speaking threat group responsible
for many large-scale attacks involving highly targeted email
attacks as well as massive, multi-million message campaigns since
at least 2014.

Group-IB researchers did not share the names of the banks targeted
by Silence APT but said that the group successfully targeted banks
in India (in August 2018), Russia (in February 2019, Russian “IT
Bank”), Kyrgyzstan (in May 2019), Russia (in June 2019), and Chile,
Ghana, Costa Rica, and Bulgaria (in July 2019).

Group-IB has published more detailed findings about Silence APT
in its new
report^[3] titled, “Silence 2.0:
Going Global.” You can head on to its report for more
information.