ATK86

ATK86 (aka: Silence Group) is a Cybercrime group that has been active since the end of 2016, and has attacked mostly banks all over the world. The group is believed to be from a Russia, because most of their attacks (at least at the beginning), were directed against banks from Russia and former Soviet Union counties. Furthermore, they used very high level of Russian in their phishing emails, and it was found that some of the commands of their tools were in Russian. However, along the years, the group has shifted to attack banks all over the world such as in East Asia, Europe and more.

The group is known for their sophisticated and profound attacks, in which usually they take a long period of time to study the potential victim, to maximize the attack against them. In most cases, Spear-phishing emails were sent to bank employees, while having a malicious file attached to them. This usually downloaded the Silence Trojan that has many capabilities of stealing data, downloading additional tolls, track victims and more. A few versions of the toll were found, and it has shown that the group is continuing to enhance them. Furthermore, the group uses malwares to attack ATMs specifically, such as Atmosphere. At the begenning, the tools used to target ATM were developped by other cyber criminals but the group is currently useing homemade tools. Through this, the group was able to steal millions of dollars in cash along the years, mostly from banks in Russia, and Eastern Europe.

Some IP addresses used during theses attacks seems to be located in France, mostly from the OVH hoster.

In 2020 the group started to target Banks in Sub-Saharian Africa and threatens Australian banks of DDoS attacks if they will not pay large sums in Monero cryptocurrency.

According to Group-IB the Silence group started to by to TA505 access to banks which correlate with the diminution of spear-phishing attempt from Silence. TA505 seems to have sold at least the access to one European bank to Silence in end 2019.