Thursday, July 18, 2024

Silence Trojan Targeting Financial Institutions Recording day to day activity on Bank Employees’ PCs

Security experts from Kaspersky lab discovered a new trojan dubbed Silence trojan that targeting Financial institutions. It was first spotted September this year and they are primarily targetting Russian banks.

Attackers beyond Silence Trojan using spear-phishing methods as an initial attack vector to gain access to the bank network.

Once they gained a persistent access to bank networks they record day to day activity of bank employees’ PCs and gather as much as possible information to loot money.

Also Read Dangerous Crypto Currency Mining Malware Apps Found on Google Play Store

How does it work – Silence Trojan

Attackers distributing trojans with spear-phishing emails using employees email address of the organization that compromised already by requesting to open an account in the bank.

Kaspersky researchers spotted a compiled HTML file(CHTML) in the attachment which is highly interactive and contains Javascript which redirects the victim to external URL after opening the CHM file.
Source: Kaspersky

The end goal of the script is to download and execute obfuscated.VBS script which then downloads the final dropper.

Payload Communication

Then dropper executes and connects with C&C server and downloads the payload, which is capable of performing various tasks like screen recording, data uploading etc. The main task of the payload is to monitor the victim’s activity.

In order to do so, it takes multiple screenshots of the victim´s active screen, providing a real-time pseudo-video stream with all the victim´s activity. A very similar technique was used in the Carbanak case, where this monitoring was used to understand the victim´s day to day activity.Researchers said.

Hackers targeting financial organizations to make money, you can find the detailed analysis with Kaspersky’s blog. It is evident still spear-phishing infection vector is the most popular way.




Latest articles

Octo Tempest Know for Attacking VMWare ESXi Servers Added RansomHub & Qilin to Its Arsenal

Threat actors often attack VMware ESXi servers since they accommodate many virtual machines, which...

TAG-100 Actors Using Open-Source Tools To Attack Gov & Private Orgs

Hackers exploit open-source tools to execute attacks because they are readily available, well-documented, and...

macOS Users Beware Of Weaponized Meeting App From North Korean Hackers

Meeting apps are often targeted and turned into weapons by hackers as they are...

Hackers Exploiting Legitimate RMM Tools With BugSleep Malware

Since October 2023, MuddyWater, which is an Iranian threat group linked to MOIS, has...

Cybercriminals Exploit Attack on Donald Trump for Crypto Scams

Researchers at Bitdefender Labs remain ever-vigilant, informing users about the latest scams and internet...

New TE.0 HTTP Request Smuggling Flaw Impacts Google Cloud Websites

HTTP Request Smuggling is a flaw in web security that is derived from variations...

Volcano Demon Group Attacking Organizations With LukaLocker Ransomware

The Volcano Demon group has been discovered spreading a new ransomware called LukaLocker, which...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles