• Skip to main content
  • Skip to secondary menu
  • Skip to primary sidebar
  • Home
  • Contact Us

iHash

News and How to's

  • The 2023 Travel Hacker Bundle ft. Rosetta Stone Lifetime Subscription for $199

    The 2023 Travel Hacker Bundle ft. Rosetta Stone Lifetime Subscription for $199
  • Apple iPad Air 2, 16GB – Silver (Refurbished: Wi-Fi Only) for $106

    Apple iPad Air 2, 16GB – Silver (Refurbished: Wi-Fi Only) for $106
  • S300 eufyCam (eufyCam 3C) 3-Cam Kit for $579

    S300 eufyCam (eufyCam 3C) 3-Cam Kit for $579
  • eufy Baby Monitor 2 (2K, Smart, Wi-Fi) for $119

    eufy Baby Monitor 2 (2K, Smart, Wi-Fi) for $119
  • eufy SpaceView Add-On Video Baby Monitor for $99

    eufy SpaceView Add-On Video Baby Monitor for $99
  • News
    • Rumor
    • Design
    • Concept
    • WWDC
    • Security
    • BigData
  • Apps
    • Free Apps
    • OS X
    • iOS
    • iTunes
      • Music
      • Movie
      • Books
  • How to
    • OS X
      • OS X Mavericks
      • OS X Yosemite
      • Where Download OS X 10.9 Mavericks
    • iOS
      • iOS 7
      • iOS 8
      • iPhone Firmware
      • iPad Firmware
      • iPod touch
      • AppleTV Firmware
      • Where Download iOS 7 Beta
      • Jailbreak News
      • iOS 8 Beta/GM Download Links (mega links) and How to Upgrade
      • iPhone Recovery Mode
      • iPhone DFU Mode
      • How to Upgrade iOS 6 to iOS 7
      • How To Downgrade From iOS 7 Beta to iOS 6
    • Other
      • Disable Apple Remote Control
      • Pair Apple Remote Control
      • Unpair Apple Remote Control
  • Special Offers
  • Contact us

Russian Hacking Group Targeting Banks Worldwide With Evolving Tactics

Aug 21, 2019 by iHash Leave a Comment

silence apt hacking group

Silence APT, a Russian-speaking cybercriminal group, known for targeting financial organizations primarily in former Soviet states and neighboring countries is now aggressively targeting banks in more than 30 countries across America, Europe, Africa, and Asia.

Active since at least September 2016, Silence APT group’s most recent successful campaign was against Bangladesh-based Dutch-Bangla Bank, which lost over $3 million during a string of ATM cash withdrawals over a span of several days.

According to a new report Singapore-based cybersecurity firm Group-IB shared with The Hacker News, the hacking group has significantly expanded their geography in recent months, increased the frequency of their attack campaigns, as well as enhanced its arsenal.

The report also describes the evolution of the Silence hacking group from “young and highly motivated hackers” to one of the most sophisticated advanced persistent threat (APT) group that is now posing threats to banks worldwide.

Silence APT hacking group has updated their unique TTP (tactics, techniques, and procedures) and changed their encryption alphabets, string encryption, and commands for the bot and the main module to evade detection by security tools.

“In addition, the actor has completely rewritten TrueBot loader, the first-stage module, on which the success of the group’s entire attack depends. The hackers also started using Ivoke, a fileless loader, and EDA agent, both written in PowerShell,” the researchers said.

EDA is a PowerShell agent, designed to control compromised systems by performing tasks through the command shell and tunneling traffic using the DNS protocol, and is based on the Empire and dnscat2 projects.

hacking groups

Just like most hacking groups, Silence gang also relies on spear-phishing emails with macros Docs or exploits, CHM files, and .LNK shortcuts as malicious attachments to initially compromise their victims.

Once in a victim organization, the group leverages more sophisticated TTPs and deploy additional malware, either TrueBot or a new fileless PowerShell loader called Ivoke, both designed to collect information about an infected system and send it to an intermediate CnC server.

To choose their targets, the group first create an up-to-date “target list” of active email addresses by sending “recon emails,” which usually contain a picture or a link without a malicious payload.

“These campaigns were no longer focused just on Russia and former Soviet countries but spread across Asia and Europe. Since our last public report, Silence has sent out more than 170,000 recon emails to banks in Russia, the former Soviet Union, Asia, and Europe,” the report reads.

“In November 2018, Silence tried their hand at targeting the Asian market for the first time in their history. In total, Silence sent out about 80,000 emails, with more than half of them targeting Taiwan, Malaysia, and South Korea.”

Featuring Silence APT group’s latest campaigns—from May 2018 through 1 August 2019—researchers described the increase in damage from their operations and confirmed that the amount of funds stolen by Silence had increased fivefold since its initial stage, estimating the total loss of $4.2 million.

Besides this, Group-IB researchers also suspect that TrueBot (aka Silence.Downloader) and FlawedAmmyy loader have been developed by the same person as both malware were signed with the same digital certificate.

phishing emails

FlawedAmmyy loader is a remote access Trojan (RAT) associated with TA505, a separate Russian-speaking threat group responsible for many large-scale attacks involving highly targeted email attacks as well as massive, multi-million message campaigns since at least 2014.

“The growing threat posed by Silence and its rapid global expansion prompted us to make both reports publicly available in order to help cyber security specialists detect and correctly attribute Silence’s worldwide attacks at an early stage,” the researchers said.

Group-IB researchers did not share the names of the banks targeted by Silence APT but said that the group successfully targeted banks in India (in August 2018), Russia (in February 2019, Russian “IT Bank”), Kyrgyzstan (in May 2019), Russia (in June 2019), and Chile, Ghana, Costa Rica, and Bulgaria (in July 2019).

Group-IB has published more detailed findings about Silence APT in its new report titled, “Silence 2.0: Going Global.” You can head on to its report for more information.

Source link

Share this:

  • Facebook
  • Twitter
  • Pinterest
  • LinkedIn

Filed Under: Security Tagged With: Banks, cyber attacks, cyber crime, Cyber Security, cyber threats, cybersecurity, data breaches, Evolving, Group, hacker, hacker news, hacking, hacking news, how to hack, incident response, information security, network security, risk management, russian, security breaches, security vulnerabilities, Tactics, Targeting, the hacker news, web applications, Worldwide

Special Offers

  • The 2023 Travel Hacker Bundle ft. Rosetta Stone Lifetime Subscription for $199

    The 2023 Travel Hacker Bundle ft. Rosetta Stone Lifetime Subscription for $199
  • Apple iPad Air 2, 16GB – Silver (Refurbished: Wi-Fi Only) for $106

    Apple iPad Air 2, 16GB – Silver (Refurbished: Wi-Fi Only) for $106
  • S300 eufyCam (eufyCam 3C) 3-Cam Kit for $579

    S300 eufyCam (eufyCam 3C) 3-Cam Kit for $579
  • eufy Baby Monitor 2 (2K, Smart, Wi-Fi) for $119

    eufy Baby Monitor 2 (2K, Smart, Wi-Fi) for $119
  • eufy SpaceView Add-On Video Baby Monitor for $99

    eufy SpaceView Add-On Video Baby Monitor for $99

Reader Interactions

Leave a Reply Cancel reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Primary Sidebar

  • Facebook
  • GitHub
  • Instagram
  • Pinterest
  • Twitter
  • YouTube

More to See

@insideBIGDATApodcast: ChatGPT – The Human AI Partnership

Jan 29, 2023 By iHash

Gootkit Malware Continues to Evolve with New Components and Obfuscations

Jan 29, 2023 By iHash

Tags

* Apple Cisco computer security cyber attacks cyber crime cyber news cybersecurity Cyber Security cyber security news cyber security news today cyber security updates cyber threats cyber updates data breach data breaches google hacker hacker news Hackers hacking hacking news how to hack incident response information security iOS 7 iOS 8 iPhone Malware microsoft network security ransomware ransomware malware risk management Secure security security breaches security vulnerabilities software vulnerability the hacker news Threat update video Vulnerabilities web applications

Latest

The 2023 Travel Hacker Bundle ft. Rosetta Stone Lifetime Subscription for $199

Expires January 30, 2024 23:59 PST Buy now and get 94% off Rosetta Stone: Lifetime Subscription (All Languages) KEY FEATURES The benefits of learning to speak a second language (or third) are immeasurable! With its intuitive, immersive training method, Rosetta Stone will have you reading, writing, and speaking new languages like a natural in no […]

Apple iPad Air 2, 16GB – Silver (Refurbished: Wi-Fi Only) for $106

Expires July 11, 2120 23:59 PST Buy now and get 40% off KEY FEATURES The iPad Air 2 boasts 40% faster CPU performance and 2.5 times the graphics performance when compared to its predecessor. Its 9.7″ LED-backlit Retina IPS LCD with a resolution of 2048×1536 provides richer colors, greater contrast, and sharper images for a […]

S300 eufyCam (eufyCam 3C) 3-Cam Kit for $579

Expires January 03, 2123 19:28 PST Buy now and get 0% off KEY FEATURES See 4K Detail Day and Night 180-Day Battery Life Up to 16 TB Expandable Local Storage (Additional Storage Drive Not Included) BionicMind AI Differentiates Family and Strangers HomeBase 3 Centralize Security Management PRODUCT SPECS Resolution 4K (3840×2160)° Night Vision Infrared & […]

eufy SpaceView Add-On Video Baby Monitor for $99

Expires January 28, 2123 06:33 PST Buy now and get 0% off Sweet Dreams on the Big Screen: The large 5″ 720p video baby monitor display shows a sharp picture with 10 times more detail than ordinary 240p-display baby monitors. Long-Lasting Views: Watch your baby for up to 15 hours per chargeplenty of time to […]

ISC Releases Security Patches for New BIND DNS Software Vulnerabilities

Jan 28, 2023Ravie LakshmananServer Security / DNS The Internet Systems Consortium (ISC) has released patches to address multiple security vulnerabilities in the Berkeley Internet Name Domain (BIND) 9 Domain Name System (DNS) software suite that could lead to a denial-of-service (DoS) condition. “A remote attacker could exploit these vulnerabilities to potentially cause denial-of-service conditions and […]

eufy Solo IndoorCam C24 (2K, 2-Cam Kit, Plug-in) for $75

Expires January 04, 2123 21:34 PST Buy now and get 0% off KEY FEATURES Knows Whos There: The on-device AI instantly determines whether a human or pet is present within the cameras view. The Key is in the Detail: View every event in up to 2K clarity (1080P while using HomeKit) so you see exactly […]

Jailbreak

Pangu Releases Updated Jailbreak of iOS 9 Pangu9 v1.2.0

Pangu has updated its jailbreak utility for iOS 9.0 to 9.0.2 with a fix for the manage storage bug and the latest version of Cydia. Change log V1.2.0 (2015-10-27) 1. Bundle latest Cydia with new Patcyh which fixed failure to open url scheme in MobileSafari 2. Fixed the bug that “preferences -> Storage&iCloud Usage -> […]

Apple Blocks Pangu Jailbreak Exploits With Release of iOS 9.1

Apple has blocked exploits used by the Pangu Jailbreak with the release of iOS 9.1. Pangu was able to jailbreak iOS 9.0 to 9.0.2; however, in Apple’s document on the security content of iOS 9.1, PanguTeam is credited with discovering two vulnerabilities that have been patched.

Pangu Releases Updated Jailbreak of iOS 9 Pangu9 v1.1.0

  Pangu has released an update to its jailbreak utility for iOS 9 that improves its reliability and success rate.   Change log V1.1.0 (2015-10-21) 1. Improve the success rate and reliability of jailbreak program for 64bit devices 2. Optimize backup process and improve jailbreak speed, and fix an issue that leads to fail to […]

Activator 1.9.6 Released With Support for iOS 9, 3D Touch

  Ryan Petrich has released Activator 1.9.6, an update to the centralized gesture, button, and shortcut manager, that brings support for iOS 9 and 3D Touch.

Copyright iHash.eu © 2023
We use cookies on this website. By using this site, you agree that we may store and access cookies on your device. Accept Read More
Privacy & Cookies Policy

Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Non-necessary
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.
SAVE & ACCEPT