Silence group targeting Russian Banks via Malicious CHM

guest · Jan 24, 2019

Silence group targeting Russian Banks via Malicious CHM
January 24, 2019
https://reaqta.com/2019/01/silence-group-targeting-russian-banks/

The main vector is represented by a malicious CHM file. Despite being an “obsolete” format, CHM has been effectively used in the past to run malicious code. In this case it is used to download components that are part of the infection chain, in addition to running native OS binaries to collect information related to its targets.

[...] file structure is similar to that of a hypertext page, is opened through the native Microsoft Windows program “hh.exe”. The CHM file contains a HTM file called “start.htm“ that runs once the file is opened and contains the malicious payload, used to start cmd.exe and mshta.exe to download a malicious VBscript [...]

The infection process, attack chain and the way the operation is structured, shows that Silence group, though still young, is an increasingly more organized and dangerous banking malware distribution entity.
Click to expand...

guest · Apr 17, 2019

Silence Group Playbook
April 15, 2019
https://www.fortinet.com/blog/threat-research/silence-group-playbook.html

The modus operandi of the Silence Group is simple. It is to make as much money as possible by compromising targets, in this case banks, via a spear phishing strategy, which will then lead to exfiltrating financial data as well as also allow the attackers to “Jackpot” ATMs to withdraw money.

To achieve these goals, the Silence Group is known to utilize publicly available tools that they repurpose, as well as use a technique that the cybersecurity industry refers to as “living off the land.”

Like most attacks, the typical Silence Group threat begins with a spear phishing email with malicious attachments. The attachments may be in the form of a weaponized Microsoft Word document or a Microsoft-compiled html help (CHM) file sent to banks to entice their users to click on the attachments. These malicious emails generally contain infected Word documents or weaponized help files. [...]
Click to expand...

Minimalist · Jul 3, 2019

Russian 'Silence' hacking crew turns up the volume – with $3m-plus cyber-raid on bank's cash machines

A prominent Russian hacker crew is seemingly expanding its reach – having just pulled off a multi-million dollar cyber-heist in Bangladesh, we're told.

Moscow-based security outfit Group-IB told The Reg it believes the crooks, dubbed Silence, stole at least $3m (£2.4m) from Bangladesh-based Dutch-Bangla Bank via a string of cash-machine withdrawals over a span of several days.
Click to expand...

https://www.theregister.co.uk/2019/07/03/silence_hacking_bangla/

Log in or Sign up

Silence group targeting Russian Banks via Malicious CHM

guest Guest

guest Guest

Minimalist Registered Member

Log in or Sign up

Silence group targeting Russian Banks via Malicious CHM

guest Guest

guest Guest

Minimalist Registered Member

Useful Searches