Operation Silent Skimmer

Also known as: Operation Silent Skimmer

(BlackBerry) BlackBerry has discovered a new campaign we’ve dubbed “Silent Skimmer,” involving a financially motivated threat actor targeting vulnerable online payment businesses in the APAC and NALA regions. The attacker compromises web servers, using vulnerabilities to gain initial access. The final payload deploys payment scraping mechanisms on compromised websites to extract sensitive financial data from users. The campaign has been active for over a year, and targets diverse industries that host or create payment infrastructure, such as online businesses and Point of Sales (POS) providers. We have uncovered evidence suggesting the threat actor is proficient in the Chinese language, and operates predominantly in the Asia-Pacific (APAC) region.

🌍 Country ["[Unknown]"]

Introduction

(BlackBerry) BlackBerry has discovered a new campaign we’ve dubbed “Silent Skimmer,” involving a financially motivated threat actor targeting vulnerable online payment businesses in the APAC and NALA regions. The attacker compromises web servers, using vulnerabilities to gain initial access. The final payload deploys payment scraping mechanisms on compromised websites to extract sensitive financial data from users. The campaign has been active for over a year, and targets diverse industries that host or create payment infrastructure, such as online businesses and Point of Sales (POS) providers. We have uncovered evidence suggesting the threat actor is proficient in the Chinese language, and operates predominantly in the Asia-Pacific (APAC) region.

Activities and Tactics

Country of Origin: 🏳️ [“[Unknown]”]

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • BadPotato
  • Cobalt Strike
  • GodPotato
  • Godzilla
  • JuicyPotato
  • Living off the Land
  • PowerShell RAT
  • SharpToken
  • SweetPotato
  • BadPotato:
  • Cobalt Strike:
  • GodPotato:
  • Godzilla:
  • JuicyPotato:
  • Living off the Land:
  • PowerShell RAT:
  • SharpToken:
  • SweetPotato:

Attribution and Evidence

Country of Origin: [“[Unknown]”] Additional attribution information pending cataloguing.

References

References pending cataloguing.