SilverTerrier

Executive Summary

SilverTerrier is a Nigerian threat group active since 2014, targeting high-tech, education, and manufacturing sectors primarily through espionage activities. They employ malware for data exfiltration and are known to use tools like NETWIRE and DarkComet.

Goals & Targeting

SilverTerrier's primary motivation is espionage, targeting sectors that hold valuable intellectual property and sensitive information. Their choice of high technology and education sectors indicates a desire to acquire advanced knowledge and data. The targeted countries may include those with significant industrial capabilities in manufacturing, particularly the US and EU nations.

SilverTerriet, a Nigerian cyber-espionage group, has been active since 2014, focusing on sectors with sensitive information such as high technology, higher education, and manufacturing. They utilize malware and malicious emails to gain unauthorized access, often aiming for long-term data collection. Their activities include targeted spear-phishing campaigns using tools like NETWIRE, DarkComet, and others. While their exact targets are unclear beyond the initial data, they have shown a steady operational pattern over several years, suggesting a focus on sustained information gathering rather than immediate financial gain.

Key Capabilities

• Use of malware for unauthorized access
• Spear-phishing campaigns
• Data exfiltration

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

SilverTerrier has a sustained operational presence, likely focusing on long-term data theft without prominent high-profile campaigns. Targeting of specific sectors over an extended period suggests a strategic focus on infiltrating organizations with sensitive information.

IOC Patterns

• Spear-phishing emails
• Malware distribution via email attachments
• Use of malicious file transfer protocols

Recommended Actions

• Implement multi-factor authentication (MFA)
• Enhance email filtering to detect phishing attempts
• Monitor network traffic for suspicious activities
• Regularly update software and systems with security patches

Suggested Tags