How the Silence attacks happened
Experts were able to piece together how an attack with the Silence trojan works. It all begins with the hackers gaining access to a bank employee's email account. This can be done with malware or because the employee had reused passwords from accounts included in publicly leaked datasets.
The Silence group uses the bank employee's compromised account to send spear-phishing emails to other bank workers. The purpose is to identify other employees with access to sensitive bank management systems.
These emails contain a CHM (compiled HTML) file attachment. If the victim downloads and opens this file, the CHM file runs JavaScript commands that download and install a first-stage malware payload.
This is what experts call a "dropper." In this particular case, it's a Win32 executable that collects data on infected hosts and sends the info to the attackers' command and control (C&C) servers.
Silence works by recording a pseudo-video stream
If the C&C servers deem the PC valuable, they send over a second-stage payload, the Silence trojan. Silence's main feature is its ability to take repeated screenshots of the user's desktop.
The images are taken at quick intervals and uploaded to the C&C server, creating a real-time pseudo-video stream with the bank employee's activity.
Attackers most likely chose to take screenshots instead of recording an actual video because it uses fewer PC resources and allows Silence to remain undetected, hence the trojan's name.
The Silence group can later review these screenshots and look for data that may aid them in planning further stages of their attack, such as identifying URLs for internal bank money management systems, local applications they can exploit, or get an overview of other computers on the local network.
According to Kaspersky, the group then leverages legitimate Windows administration tools to fly under the radar in their post-exploitation phase,
a technique used by the Carbanak group in the past.
Kaspersky did not reveal how the attack continues past this point, which banks were infected, or how much money attackers stole.
Bank robbers are getting creative
The Silence attacks are not the only cyber-heists carried out against Russian banks. Trustwave SpiderLabs found another hacking crew that used a
new "overdraft" technique to rob banks, managing to steal over $40 million from several Eastern European financial organizations.
Other clever techniques used by Carbanak in past attacks include
the use of Google legitimate services — Google Apps Script, Google Sheets, and Google Forms — to host C&C servers; and
calling and tricking tech support department employees into opening malware-laden documents. The computers of tech support department employees are then used as pivot points for attacks or reconnaissance operations.
A technical analysis of the Silence trojan, along with IOCs, are available in Kasperksy's report here.
