Silence 2.0: Going Global

Executive summary: This Group-IB report documents the Silence 2.0: Going Global operation, tracing the group's evolution from 2016–2019, their shift from regional to global targeting of financial institutions, and their toolkit (Silence.Download/TrueBot, Ivoke, EmpireDNSAgent/EDA, Atmosphere, ProxyBot) used to conduct phishing, fileless execution, C2 communications, and ATM/card-skimming attacks across 30+ countries, with notable incidents such as Dutch-Bangla Bank and IT Bank, alongside IOCs and a comparison to FlawedAmmyy.