APT GroupSOCRadar source-of-truth import; pending cross-source consensus confidence

Operation Silent Skimmer

Operation Silent Skimmer is a financially motivated cyber threat group that emerged in May 2023, primarily focused on stealing credit card information from Point-of-Sale (PoS) systems and online payment gateways. The group is assessed with high confidence to be of Chinese origin, and its operations have evolved from injecting malicious code onto payment pages to directly accessing payment databases via compiled Python scripts. This group distinguishes itself through its consistent exploitation of vulnerabilities in third-party web application components, such as Telerik UI, and its adaptive use of short-lived virtual private servers for command and control, often geographically aligned with its victims. While not an alias, the group's web skimming activities are sometimes discussed in the broader context of other payment card skimming groups like Magecart.

Directory Briefing

Top 10 Talking Points

Operation Silent Skimmer should be treated as an intrusion cluster, not a single immutable toolkit.¹

Vendor aliases describe overlapping activity sets; attribution can guide hypotheses, but containment should be driven by the behaviors and access paths actually observed.

Initial access should be scoped across identity and Internet-facing systems.¹

The retained behavior points to credentials, remote access, phishing, or exposed services; preserve authentication, VPN, edge-device, email, and remote-administration evidence together.

The first detected host should not define the compromise boundary.¹

Check for earlier credential use, remote sessions, administrative changes, and data access because public actor records often understate the full pre-impact timeline.

Identity scope should remain open until authentication evidence is reviewed.¹

Absence of a named credential technique is not evidence that accounts are clean; validate privileged use, new sessions, MFA changes, and service-account activity.

The investigation should distinguish transient execution from durable access.¹

Review accounts, scheduled execution, remote-management tooling, cloud configuration, and externally reachable infrastructure for residual access.

Legitimate administration tools may carry much of the attack.¹

Reported tooling or behavior includes PowerShell, remote execution, or other dual-use administration behavior; detection must distinguish authorized administration from anomalous context and sequence.

Preserve independent telemetry before containment changes the scene.¹

Endpoint, identity, network, cloud, email, and backup logs provide the cross-check needed when the actor's public record does not clearly describe defense evasion.

The actor's objective should be inferred from evidence, not the label.¹

Determine whether the intrusion was positioned for espionage, theft, disruption, access resale, or a later-stage operation before briefing impact.

Public victimology is too sparse for confident sector conclusions.¹

Do not turn missing target data into reassurance; assess the organization's exposed technology, identity paths, valuable data, and disruptive leverage instead.

The first briefing should separate containment confidence from attribution confidence.¹

State what access is confirmed, what persistence has been closed, what information may have been collected, and which attribution judgments remain source-bound.

Bottom Line Up Front

BLUF

Operation Silent Skimmer should be treated as an intrusion cluster, not a single immutable toolkit.¹

Vendor aliases describe overlapping activity sets; attribution can guide hypotheses, but containment should be driven by the behaviors and access paths actually observed.

Initial access should be scoped across identity and Internet-facing systems.¹

The retained behavior points to credentials, remote access, phishing, or exposed services; preserve authentication, VPN, edge-device, email, and remote-administration evidence together.

The first detected host should not define the compromise boundary.¹

Check for earlier credential use, remote sessions, administrative changes, and data access because public actor records often understate the full pre-impact timeline.

Identity scope should remain open until authentication evidence is reviewed.¹

Absence of a named credential technique is not evidence that accounts are clean; validate privileged use, new sessions, MFA changes, and service-account activity.

The investigation should distinguish transient execution from durable access.¹

Review accounts, scheduled execution, remote-management tooling, cloud configuration, and externally reachable infrastructure for residual access.

Legitimate administration tools may carry much of the attack.¹

Preserve independent telemetry before containment changes the scene.¹

Endpoint, identity, network, cloud, email, and backup logs provide the cross-check needed when the actor's public record does not clearly describe defense evasion.

The actor's objective should be inferred from evidence, not the label.¹

Determine whether the intrusion was positioned for espionage, theft, disruption, access resale, or a later-stage operation before briefing impact.

Public victimology is too sparse for confident sector conclusions.¹

Do not turn missing target data into reassurance; assess the organization's exposed technology, identity paths, valuable data, and disruptive leverage instead.

The first briefing should separate containment confidence from attribution confidence.¹

State what access is confirmed, what persistence has been closed, what information may have been collected, and which attribution judgments remain source-bound.

Decision Context

Executive Summary

Actor Card Detail

Actor Profile

Entity Type¹

APT Group profile

First Seen¹

2023-05-01

Last Seen¹

2024-05-31

Origin¹

Motivation¹

Financial crime

Primary Access Pattern¹

T1059.001

Objective¹

Financial crime

Victimology

Named Victims / Public Disclosures

No named victim organizations are retained in the cited source artifacts for this profile. Countries and sectors are targeting context, not victim identities.

Identity

Aliases And Boundaries

Aliases¹

Source Boundary

SOCRadar is the retained baseline for this profile. IntelliOS preserves source labels as discovery and comparison signals until a cited source explicitly supports a merge, split, or actor-boundary change.

Targeting

Targets, Activity, And ATT&CK

Target Countries / Exposure¹

CanadaLao People's Democratic RepublicUnited States

Target Sectors¹

Not available

Associated Activity¹

Initial Access: Exploitation of web-facing Telerik UI vulnerabilities, specifically CVE-2019-18935 and CVE-2017-11317.Execution & Persistence: Presence of malicious DLLs or JavaScript files ('compiled.js', 'jquery.hoverIntent.js', 'checkout.js') on compromised web servers, especially in the 'inetpub\wwwroot' directory.Execution & Persistence: Deployment of web shells in directories like 'C:\Users\Public\Music\' or 'C:\WebRoot\Health Checks\Default'.Command and Control: Unusual network traffic to external, often short-lived, Virtual Private Servers (VPS) acting as C2 infrastructure.Discovery & Privilege Escalation: Use of PowerShell utility scripts for reconnaissance or privilege escalation tools like GodPotato.Defense Evasion: Execution of 'mshta.exe' downloading and executing remote HTA payloads.Exfiltration: Deployment of compiled Python scripts designed to access and export payment databases to CSV files.Impact: Unauthorized access to Point-of-Sale (PoS) systems or online payment gateways resulting in credit card data theft.

ATT&CK IDs¹

T1059.001T1071.001T1047

Campaign Context

Associated Campaigns / Operations

Campaign / Operation	Source-Backed Context
Operation Silent Skimmer¹	Operation Silent Skimmer
Operation Silent Skimmer¹	SOCRadar baseline: Operation Silent Skimmer
Operation Silent Skimmer¹	SOCRadar retains Operation Silent Skimmer as an APT Group card with China origin and Canada, Laos, and United States exposure context.
Operation Silent Skimmer²	IntelliOS treats Operation Silent Skimmer as campaign-style financially motivated web-skimming activity, not a proven formal organization identity.
Operation Silent Skimmer¹	IntelliOS excludes raw payment-skimming scripts, victim payment data, webshell URLs, C2 infrastructure, and exploit instructions from the Operation Silent Skimmer card.
Operation Silent Skimmer¹	Operation Silent Skimmer is a financially motivated cyber threat group that emerged in May 2023, primarily focused on stealing credit card information from Point-of-Sale (PoS) systems and online payment gateways. The group is assessed with high confidence t...

Indicators

IOCs And Observable Retention

SOCRadar reported 762¹IntelliOS retained 69^{1,2,4,5,6,7,8}

SOCRadar reports 762 IOCs for this profile. IntelliOS currently retains 69 cited public observable/context rows; this is not the full possible public-source IOC corpus.

Source coverage: 10 source groups tracked; 8 currently contribute retained observable or context rows.

Retained Observables

Showing 60 of 69

Type	Value	Source
Tool / Process	APAC to NALA targeting shift²	Operation Silent Skimmer threat group card
Tool / Process	BadPotato²	Operation Silent Skimmer threat group card
Tool / Process	Cobalt Strike²	Operation Silent Skimmer threat group card
Tool / Process	CVE-2017-11317 unrestricted upload / weak encryption context⁷	CVE-2017-11317
Tool / Process	CVE-2019-18935 insecure deserialization / remote code execution context⁶	CVE-2019-18935
Tool / Process	Do not treat campaign name as a confirmed formal organization identity²	Operation Silent Skimmer threat group card
Tool / Process	Financially motivated web-skimming campaign²	Operation Silent Skimmer threat group card
Tool / Process	GodPotato²	Operation Silent Skimmer threat group card
Tool / Process	Godzilla webshell²	Operation Silent Skimmer threat group card
Tool / Process	JuicyPotato²	Operation Silent Skimmer threat group card
Tool / Process	Living off the land²	Operation Silent Skimmer threat group card
Tool / Process	Online payment business targeting²	Operation Silent Skimmer threat group card
Tool / Process	Payment scraping from compromised websites²	Operation Silent Skimmer threat group card
Tool / Process	Persistence after Telerik exploitation⁴	Silent Skimmer gets loud again
Tool / Process	Point-of-sale provider targeting²	Operation Silent Skimmer threat group card
Tool / Process	PowerShell RAT²	Operation Silent Skimmer threat group card
Tool / Process	Python script usage in 2024 resurgence⁴	Silent Skimmer gets loud again
Tool / Process	Reconnaissance commands after web-server compromise²	Operation Silent Skimmer threat group card
Tool / Process	Sensitive payment-data extraction²	Operation Silent Skimmer threat group card
Tool / Process	SharpToken²	Operation Silent Skimmer threat group card
Tool / Process	SweetPotato²	Operation Silent Skimmer threat group card
Tool / Process	Telerik UI exploitation for initial access⁴	Silent Skimmer gets loud again
Tool / Process	Vulnerable web-server compromise²	Operation Silent Skimmer threat group card
ATT&CK ID	T1005 - Data from Local System²	Operation Silent Skimmer threat group card
ATT&CK ID	T1041 - Exfiltration Over C2 Channel²	Operation Silent Skimmer threat group card
ATT&CK ID	T1046 - Network Service Discovery²	Operation Silent Skimmer threat group card
ATT&CK ID	T1055 - Process Injection²	Operation Silent Skimmer threat group card
ATT&CK ID	T1059.001 - PowerShell²	Operation Silent Skimmer threat group card
ATT&CK ID	T1059.006 - Python⁴	Silent Skimmer gets loud again
ATT&CK ID	T1068 - Exploitation for Privilege Escalation²	Operation Silent Skimmer threat group card
ATT&CK ID	T1078 - Valid Accounts²	Operation Silent Skimmer threat group card
ATT&CK ID	T1082 - System Information Discovery²	Operation Silent Skimmer threat group card
ATT&CK ID	T1083 - File and Directory Discovery²	Operation Silent Skimmer threat group card
ATT&CK ID	T1105 - Ingress Tool Transfer²	Operation Silent Skimmer threat group card
ATT&CK ID	T1119 - Automated Collection²	Operation Silent Skimmer threat group card
ATT&CK ID	T1190 - Exploit Public-Facing Application⁴	Silent Skimmer gets loud again
ATT&CK ID	T1505.003 - Web Shell²	Operation Silent Skimmer threat group card
ATT&CK ID	T1543.003 - Windows Service²	Operation Silent Skimmer threat group card
CVE	CVE-2017-11317 - Telerik UI unrestricted file upload / weak encryption context⁷	CVE-2017-11317
CVE	CVE-2019-18935 - Telerik UI insecure deserialization / remote code execution context⁶	CVE-2019-18935
Alias / Related Name	BlackBerry naming: Silent Skimmer²	Operation Silent Skimmer threat group card
Alias / Related Name	Operation Silent Skimmer¹	SOCRadar
Alias / Related Name	Silent Skimmer²	Operation Silent Skimmer threat group card
Alias / Related Name	SOCRadar baseline: Operation Silent Skimmer¹	SOCRadar
Malware Family	RingQ loader⁵	RingQ Loader malware leveraged in Silent Skimmer campaign
Campaign Context	2022: ETDA/BlackBerry first-seen context for Silent Skimmer payment-scraping activity.²	Operation Silent Skimmer threat group card
Campaign Context	2024-05: Unit 42 investigated resurfaced Silent Skimmer activity exploiting Telerik UI vulnerabilities and dumping payment information.⁴	Silent Skimmer gets loud again
Campaign Context	IntelliOS excludes raw payment-skimming scripts, victim payment data, webshell URLs, C2 infrastructure, and exploit instructions from the Operation Silent Skimmer card.¹	SOCRadar
CLASSIFICATION	ETDA/BlackBerry describe Silent Skimmer as a financially motivated campaign targeting online payment businesses and POS providers with payment scraping.²	Operation Silent Skimmer threat group card
CLASSIFICATION	SOCRadar retains Operation Silent Skimmer as an APT Group card with China origin and Canada, Laos, and United States exposure context.¹	SOCRadar
COUNTRY	Canada¹	SOCRadar
COUNTRY	Lao People's Democratic Republic¹	SOCRadar
COUNTRY	United States²	Operation Silent Skimmer threat group card
OBSERVABLE	Broadcom retained RingQ loader as malware leveraged in a Silent Skimmer campaign with Telerik exploitation context.⁵	RingQ Loader malware leveraged in Silent Skimmer campaign
OBSERVABLE	ETDA preserves BlackBerry's description that Silent Skimmer compromises web servers and deploys payment-scraping mechanisms on websites to extract sensitive financial data.²	Operation Silent Skimmer threat group card
OBSERVABLE	The Hacker News summarized Unit 42's Silent Skimmer resurgence and named CVE-2017-11317 and CVE-2019-18935 as exploited Telerik flaws.⁸	Silent Skimmer / Telerik exploitation recap
OBSERVABLE	Unit 42 reported May 2024 incident response findings where attackers exploited Telerik UI vulnerabilities to access web servers and dump payment information.⁴	Silent Skimmer gets loud again
REGION	Asia-Pacific²	Operation Silent Skimmer threat group card
REGION	Latin America¹	SOCRadar
REGION	North America¹	SOCRadar

Show remaining 9 observables

SECTOR	E-commerce⁴	Silent Skimmer gets loud again
SECTOR	Financial Services⁴	Silent Skimmer gets loud again
SECTOR	Hospitality⁴	Silent Skimmer gets loud again
SECTOR	Online payment businesses²	Operation Silent Skimmer threat group card
SECTOR	Point of Sale providers²	Operation Silent Skimmer threat group card
SECTOR	Retail⁴	Silent Skimmer gets loud again
SECTOR	Web hosting / payment infrastructure providers⁴	Silent Skimmer gets loud again
SOURCE_BOUNDARY	IntelliOS treats Operation Silent Skimmer as campaign-style financially motivated web-skimming activity, not a proven formal organization identity.²	Operation Silent Skimmer threat group card
SOURCE_BOUNDARY	Unit 42's 2024 reporting is retained as resurfaced activity using similar TTPs and Telerik exploitation; it does not require publishing raw payment-skimming code or victim data.⁴	Silent Skimmer gets loud again

Source	Reported	Retained	Coverage Status
SOCRadar¹	762	8	Reported IOC count and SOCRadar-backed observable rows retained in IntelliOS.
SOCRadar¹	N/A	8	Public observables or source-context rows retained and displayed.
ETDA Thailand²	N/A	41	Public observables or source-context rows retained and displayed.
BlackBerry³	N/A	0	Context source retained; no direct observable rows retained from this source yet.
Palo Alto Networks Unit 42⁴	N/A	13	Public observables or source-context rows retained and displayed.
Broadcom⁵	N/A	2	Public observables or source-context rows retained and displayed.
NVD⁶	N/A	2	Public observables or source-context rows retained and displayed.
CVEFeed⁷	N/A	2	Public observables or source-context rows retained and displayed.
The Hacker News⁸	N/A	1	Public observables or source-context rows retained and displayed.
Tenable⁹	N/A	0	Context source retained; no direct observable rows retained from this source yet.

Actor Chronology

Observed Activity Timeline

No source-backed actor-activity dates are currently retained. Publication and record-maintenance dates are not promoted into activity dates.

IntelliOS Intel Products

Linked Products

Flash Threat Intel Brief

Magecart / Magento Payment Skimming

It describes Telerik/web-server and payment-database activity, not a proven match to the Magento chains here. It provides a separate skimming comparison, not evidence of common operators.

Source Integrity AppendixSource reconciliation, citations, and collision-boundary analysisOpen

Source Reconciliation

How IntelliOS Keeps The Labels Straight

Source	Primary Name	Treatment	Boundary
SOCRadar	Operation Silent Skimmer	Baseline actor-card record retained for the current profile view.	Fields reflect the retained database record. Additional source consensus, collisions, and canonical identity mappings can be layered into this profile without automatically merging actors.
IntelliOS	Operation Silent Skimmer	Normalizes this record for directory search, card display, profile lookup, and future product linking.	Normalization is a presentation and workflow aid; it is not an independent attribution claim.

Open retained source profile

Source Collision Notes

Open Interpretation Boundaries

IntelliOS starts this detail page from the retained source record for Operation Silent Skimmer.

No possible same-actor, alias reuse, sub-cluster, duplicate-boundary, or external-source collision is currently retained for this actor.

Collision Source	Candidate Records	Shared Evidence	Treatment
None retained	No candidate records	No shared evidence recorded	No collision action needed.
External sources	Mandiant, CrowdStrike, other non-SOCRadar sources	None retained	External collisions are shown separately when retained.

Citations

Source Notes

#	Source	Use In Card
1	SOCRadar Threat Actor Database https://socradar.io/free-tools/threat-actor	Threat actor directory source for profile fields and reported activity.
2	Operation Silent Skimmer threat group card https://apt.etda.or.th/cgi-bin/showcard.cgi?g=Operation+Silent+Skimmer	Threat Actor Database
3	Silent Skimmer online payment scraping campaign https://blogs.blackberry.com/en/2023/09/silent-skimmer-online-payment-scraping-campaign-shifts-targets-from-apac-to-nala	Primary Threat Research (redirected original)
4	Silent Skimmer gets loud again https://unit42.paloaltonetworks.com/silent-skimmer-latest-campaign/	Primary Threat Research
5	RingQ Loader malware leveraged in Silent Skimmer campaign https://www.broadcom.com/support/security-center/protection-bulletin/ringq-loader-malware-leveraged-in-silent-skimmer-campaign	Protection Bulletin
6	CVE-2019-18935 https://nvd.nist.gov/vuln/detail/CVE-2019-18935	Vulnerability Record
7	CVE-2017-11317 https://cvefeed.io/vuln/detail/CVE-2017-11317	Vulnerability Record
8	Silent Skimmer / Telerik exploitation recap https://thehackernews.com/2024/11/thn-recap-top-cybersecurity-threats_11.html	News / Analysis
9	CVE-2019-18935 vulnerability details https://www.tenable.com/cve/CVE-2019-18935	Vulnerability Record

Loading Threat Actor Cards

Operation Silent Skimmer

Top 10 Talking Points

Operation Silent Skimmer should be treated as an intrusion cluster, not a single immutable toolkit.1

Initial access should be scoped across identity and Internet-facing systems.1

The first detected host should not define the compromise boundary.1

Identity scope should remain open until authentication evidence is reviewed.1

The investigation should distinguish transient execution from durable access.1

Legitimate administration tools may carry much of the attack.1

Preserve independent telemetry before containment changes the scene.1

The actor's objective should be inferred from evidence, not the label.1

Public victimology is too sparse for confident sector conclusions.1

The first briefing should separate containment confidence from attribution confidence.1

BLUF

Operation Silent Skimmer should be treated as an intrusion cluster, not a single immutable toolkit.1

Initial access should be scoped across identity and Internet-facing systems.1

The first detected host should not define the compromise boundary.1

Identity scope should remain open until authentication evidence is reviewed.1

The investigation should distinguish transient execution from durable access.1

Legitimate administration tools may carry much of the attack.1

Preserve independent telemetry before containment changes the scene.1

The actor's objective should be inferred from evidence, not the label.1

Public victimology is too sparse for confident sector conclusions.1

The first briefing should separate containment confidence from attribution confidence.1

Executive Summary

Actor Profile

Named Victims / Public Disclosures

Aliases And Boundaries

Targets, Activity, And ATT&CK

Associated Campaigns / Operations

IOCs And Observable Retention

Observed Activity Timeline

Linked Products

Magecart / Magento Payment Skimming

How IntelliOS Keeps The Labels Straight

Open Interpretation Boundaries

Source Notes

Operation Silent Skimmer should be treated as an intrusion cluster, not a single immutable toolkit.¹

Initial access should be scoped across identity and Internet-facing systems.¹

The first detected host should not define the compromise boundary.¹

Identity scope should remain open until authentication evidence is reviewed.¹

The investigation should distinguish transient execution from durable access.¹

Legitimate administration tools may carry much of the attack.¹

Preserve independent telemetry before containment changes the scene.¹

The actor's objective should be inferred from evidence, not the label.¹

Public victimology is too sparse for confident sector conclusions.¹

The first briefing should separate containment confidence from attribution confidence.¹

Operation Silent Skimmer should be treated as an intrusion cluster, not a single immutable toolkit.¹

Initial access should be scoped across identity and Internet-facing systems.¹

The first detected host should not define the compromise boundary.¹

Identity scope should remain open until authentication evidence is reviewed.¹

The investigation should distinguish transient execution from durable access.¹

Legitimate administration tools may carry much of the attack.¹

Preserve independent telemetry before containment changes the scene.¹

The actor's objective should be inferred from evidence, not the label.¹

Public victimology is too sparse for confident sector conclusions.¹

The first briefing should separate containment confidence from attribution confidence.¹