SilentMarten

  • First known sample

    2022
  • Discovery

    2022
  • Number of targets

    1-100
  • Current status

    –°onsidered active
  • Type

    APT
  • Targeted platforms

    Windows
  • TOP targeted countries

    Kyrgyzstan
  • The way of propagation

    Social engineering , Trojanized software installers
  • Targets

    Government entities
  • Artefacts/Attribution

    Unclear

  • Implant

    Commercial pentesting suites, custom anti-detection wrappers and last stage Trojans.

  • Description

    The actors uses an innovative technique of putting the shellcode into Windows event logs, allowing the “fileless” last stage Trojan to be hidden from the filesystem. They employ a set of custom tools along with several commercial pentesting frameworks, such as Cobalt Strike and NetSPI (ex-SilentBreak). With these in use, plus several types of last stage RAT and anti-detection wrappers, the actor behind this campaign is quite capable. The code is quite unique, with no similarities with known malware.

    What's also noteworthy is that in September 2021 we observed the SilentBreak toolset used in malicious campaings in other regions – the Middle East and North Africa. 

    APT trends report Q2 2022 | Securelist