Silence
IntrusionSet · ATTACK:enterprise:G0091
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0091",
"title": "Silence",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0091",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--d13c8a7f-740b-4efa-a232-de7d6bb05321",
"external_id": "G0091",
"domain": "enterprise",
"created": "2019-05-24T17:57:36.491Z",
"modified": "2026-07-31T18:48:20.506Z",
"version": "2.2",
"aliases": [
"Silence",
"Whisper Spider"
],
"tactics": [
],
"source_references": [
{
"source_name": "Whisper Spider"
},
{
"source_name": "Silence"
},
{
"source_name": "Crowdstrike GTR2020 Mar 2020",
"url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"
},
{
"source_name": "SecureList Silence Nov 2017",
"url": "https://securelist.com/the-silence/83009/"
},
{
"source_name": "Cyber Forensicator Silence Jan 2019",
"url": "https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/"
}
]
}Explicit source assertions (31)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01c982c2-f610-443f-ae60-1b4a1f508f81
Group IB Silence Sept 2018ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:S0363
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1567fbd3-5d2b-4040-a736-11f3d5e2139f
Group IB Silence Aug 2019ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d7e1954-b020-4578-9a57-b1596a7a25ff
Cyber Forensicator Silence Jan 2019ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--28a76700-4834-4a1b-bb56-2005bc044e29
Group IB Silence Sept 2018ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2d49852d-083e-4379-90e3-dcb0748be624
Group IB Silence Sept 2018ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--378914cd-36cf-409f-8c99-25e144218546
Cyber Forensicator Silence Jan 2019ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--396a5415-67aa-4ec6-ae27-6be641d69e15
Group IB Silence Sept 2018ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:S0191
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--465385c3-8659-4225-82b3-215dfc66ba83
SecureList Silence Nov 2017ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5cc793b0-cc45-439e-a994-c8884ca55fe7
Group IB Silence Sept 2018ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1125
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5e60c70a-7b2f-45b8-b7d4-80e214acfb2d
SecureList Silence Nov 2017 · Group IB Silence Sept 2018ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--60989b47-4725-4077-8aed-fb5f990fda22
Cyber Forensicator Silence Jan 2019ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1218.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68602080-9968-4a36-9a5e-130343e61566
SecureList Silence Nov 2017 · Group IB Silence Sept 2018 · Group IB Silence Aug 2019 · Cyber Forensicator Silence Jan 2019ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6fc128ed-90f3-4933-8ad7-4fd4a04cb39f
Group IB Silence Sept 2018ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--778765e1-7eb6-46b1-a370-6dfe09081ee3
SecureList Silence Nov 2017 · Group IB Silence Sept 2018ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b2113c8-9b48-4f93-9090-3946a980c183
Cyber Forensicator Silence Jan 2019ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1569.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--85be49ac-785e-48af-8d0e-4b74818428fc
SecureList Silence Nov 2017 · Group IB Silence Sept 2018ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1090.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--89077d0b-aaa2-48b9-90d7-e253a550bfad
Group IB Silence Sept 2018ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--908f1fa6-c797-47c3-bcb1-3438a9105095
Group IB Silence Aug 2019ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--948146db-f966-4e0c-bbb2-289e2eae6718
Group IB Silence Sept 2018ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9569bfcd-38f8-4cb7-8470-a473ea9e4328
Group IB Silence Sept 2018ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6dc02a8-2ce3-45db-a7e5-e475d6acec3c
Group IB Silence Sept 2018ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a9c366b6-270d-4884-86dd-7c048460741b
Group IB Silence Sept 2018ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--afafd676-1b44-44ae-ad9a-930c0df348bc
Group IB Silence Sept 2018 · Cyber Forensicator Silence Jan 2019ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c3a35bf1-acfc-4e70-8be8-db843110a142
Group IB Silence Aug 2019 · SecureList Silence Nov 2017ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ccd99593-7ff0-4706-aa94-73cc8d237fe8
Group IB Silence Sept 2018 · Cyber Forensicator Silence Jan 2019ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:S0195
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--da331399-4c9f-4a16-92b1-97e635703c18
Group IB Silence Sept 2018ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--da6a811d-2a77-4f6f-a19e-2aff8662f12f
SecureList Silence Nov 2017 · Group IB Silence Sept 2018 · Cyber Forensicator Silence Jan 2019ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3038b75-63f6-44c2-9645-673bbf0ffa3b
Group IB Silence Sept 2018ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--efe23026-7cba-46df-873b-1c8244a92d36
SecureList Silence Nov 2017 · Group IB Silence Sept 2018 · Cyber Forensicator Silence Jan 2019ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f1eda5c7-6843-406d-89b8-c61759c02450
SecureList Silence Nov 2017 · Group IB Silence Sept 2018 · Cyber Forensicator Silence Jan 2019ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fdedfad5-5cb7-436a-8522-6df3f6de42b1
SecureList Silence Nov 2017 · Group IB Silence Sept 2018