Silence

Aliases: TrueBot

First seen
2016-12-01 00:00:00
Malware type
botnet, loader
Family
Malware family
Last IoC activity
2026-07-22 01:33:49
Profile updated
2026-07-07 12:54:48

Targeted industries: financial-services government-and-public-sector technology-and-telecommunications

Context

According to PCrisk, Truebot, also known as Silence.Downloader, is a malicious program that has botnet and loader/injector capabilities. This malware can add victims' devices to a botnet and cause chain system infections (i.e., download/install additional malicious programs/components). There is significant variation in Truebot's infection chains and distribution. It is likely that the attackers using this malicious software will continue to make such changes.

Detection coverage

  • 1 YARA rules

Used by threat actors

  • May 2023 Exfiltration & Wiper Activity (Truebot + FlawedGrace + MBR Killer) (campaign)
  • PaperCut Vulnerability Exploitation (campaign)
  • 2023 Increased Truebot Activity (campaign)

Exploited vulnerabilities

  • CVE-2023-27350 (vulnerability)

Detection rules

  • DITEKSHEN_MALWARE_Win_Truebot (yara-rule)

Reports & references

  • telekom.com — Cybersecurity Ta505 S Box Of Chocolate 597672 (report)
  • reaqta.com — Silence Group Targeting Russian Banks (report)
  • Kaspersky — 83009 (report)
  • Microsoft — Raspberry Robin Worm Part Of Larger Ecosystem Facilitating Pre Ransomware Activity (report)
  • github.com — Tafof Unpacker (report)
  • cert.ssi.gouv.fr — Certfr 2020 Cti 006 (report)
  • intrinsec.com — Tlp Clear 31072025 Shadowsyndicate Infrastructure Illumination En (report)
  • group-ib.com — Silence (report)
  • youtube.com — Watch (report)
  • blueliv.com — Using Qiling Framework To Unpack Ta505 Packed Samples (report)
  • outpost24.com — Using Qiling Framework To Unpack Ta505 Packed Samples (report)
  • research.loginsoft.com — Taming The Storm Understanding And Mitigating The Consequences Of Cve 2023 27350 (report)
  • Cisco Talos — Breaking The Silence Recent Truebot Activity (report)
  • prodaft.com — Rig Tlp Clear 1 (report)
  • thedfirreport.com — A Truly Graceful Wipe Out (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Silence (report)
  • norfolkinfosec.com — Some Notes On The Silence Proxy (report)
  • group-ib.com — Silence 2.0.Going Global (report)
  • intezer.com — Silenceofthemoles (report)
  • blogs.vmware.com — Carbon Blacks Truebot Detection (report)
  • huntress.com — Investigating Intrusions From Intriguing Exploits (report)
  • cert.ssi.gouv.fr — Certfr 2020 Cti 004 (report)
  • norfolkinfosec.com — How The Silence Downloader Has Evolved Over Time (report)
  • CISA — Aa23 187A (report)
  • malware.love — Analyzing Truebot Static Unpacking (report)

External references