SILENTRANSOMGROUP: 10 Victims Posted in 48 Hours — Multi-Country Extortion Campaign, Initial Access CVEs & Detection Engineering

Classification: TLP:AMBER — For internal defensive use by enterprise security teams Source: Live monitoring of SILENTRANSOMGROUP .onion leak site via ransomware.live Reporting date: 2026-08-28 Analyst: Security Arsenal — From The Dark Side

Executive Summary

SILENTRANSOMGROUP has published 10 new victim entries on its dark web leak site within a ~48-hour window (2026-08-26 through 2026-08-27), spanning multiple countries. The burst cadence — 9 postings on a single day followed by 2 the next — is consistent with either a synchronized detonation/publish cycle or a backlog dump designed to pressure victims whose negotiation windows expired simultaneously.

Sector attribution for this batch is currently unresolved: leak-site postings are redacted (e.g., "Ne...n M...") and carry no sector metadata. That redaction pattern is itself a signal — groups typically withhold full victim names and industry tags during active negotiation phases, publishing only partial identifiers as leverage. Full names, data samples, and download links usually follow 7–21 days later if payment is refused.

Who needs to act: Any organization running internet-facing Check Point Security Gateways, ConnectWise ScreenConnect, Microsoft Exchange on-premises, or unpatched Windows endpoints — the four product families represented in the CISA KEV entries correlated with current ransomware initial access activity (detailed below).

1. Threat Actor Profile — SILENTRANSOMGROUP

Key analytical caveat: SILENTRANSOMGROUP's model means traditional ransomware detection (canary files, entropy-based encryptor alerting) may never fire. Defenders must pivot detection left — to initial access, RMM tool abuse, and exfiltration.

2. Current Campaign Analysis

2.1 Victimology (from live leak-site data)

• Volume: 10 postings in the last 100 entries — all 10 within 48 hours. This is a concentrated burst, not steady-state trickle.
• Sectors: Not disclosed in current postings (redacted entries, no sector tags). Based on the group's historical pattern of targeting professional services, legal, healthcare-adjacent, and mid-market financial firms — organizations whose data carries high confidentiality/regulatory value — defenders in those verticals should treat this as elevated risk. This is an inference, not confirmed from the current batch.
• Geography: Confirmed multi-country spread. No single-country concentration, consistent with opportunistic initial access (whoever answers the callback-phishing lure or has an exploitable edge device) rather than deliberate geographic targeting.
• Victim profile: Entry naming patterns suggest small-to-mid-market organizations (no global enterprise brands in the redacted prefixes). Estimated revenue band: $10M–$500M — the sweet spot for groups that prioritize negotiable payouts over maximum disruption. Organizations this size commonly lack 24×7 SOC coverage and dedicated IR retainers, which the group exploits during the negotiation phase.

2.2 Posting cadence & escalation pattern

The 9-then-2 daily split is characteristic of expired-deadline batch publishing: victims who received simultaneous extortion contact ~2–3 weeks prior failed to pay, and their partial entries went live together. Expect:

1. Within 7–14 days: unredacted full names and sector tags for non-payers.
2. Within 14–30 days: data sample leaks, then full dumps.
3. A new extortion wave is likely already in progress against the next batch — organizations breached in mid-August may not yet know they are victims.

2.3 Correlated initial access CVEs (CISA KEV — confirmed ransomware use)

The following KEV entries overlap with this campaign's reporting window and the group's known access vectors:

Priority order for patching: Check Point gateway → ScreenConnect → Exchange → Windows link-following. The first two are remotely exploitable at the perimeter and map to this group's demonstrated tradecraft.

3. Detection Engineering

Detection strategy: because SILENTRANSOMGROUP may never detonate an encryptor, rules below focus on (a) RMM tool installation consistent with callback-phishing delivery, (b) Rclone/cloud exfil staging, and (c) pre-incident lateral movement and edge-device anomalies.

---
title: Rogue Remote Access Tool Installation - Callback Phishing Delivery (SILENTRANSOMGROUP)
id: 7c1a9f2e-4b3d-4e5a-9f11-silentrg0001
status: experimental
description: Detects installation or execution of remote access tooling (ScreenConnect, AnyDesk, Zoho Assist, Splashtop) from non-standard paths or by users without IT admin role. SILENTRANSOMGROUP operators socially engineer victims into installing RMM tooling via callback phishing lures, then use it for hands-on data theft.
author: Security Arsenal Threat Intelligence
date: 2026/08/28
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_binary:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\AnyDesk.exe'
      - '\ZohoAssist.exe'
      - '\SplashtopSOS.exe'
      - '\AteraAgent.exe'
      - '\Syncro.exe'
  selection_suspicious_path:
    Image|contains:
      - '\Users\Public\'
      - '\AppData\Local\Temp\'
      - '\Downloads\'
      - '\ProgramData\Microsoft\'
  condition: selection_binary and selection_suspicious_path
falsepositives:
  - Helpdesk-initiated installs via user Downloads folder. Baseline approved RMM tooling and alert on any binary NOT on the allowlist.
level: high
tags:
  - attack.command_and_control
  - attack.t1219
---
title: Rclone or Cloud Sync Tool Exfiltration Command Line (SILENTRANSOMGROUP)
id: 7c1a9f2e-4b3d-4e5a-9f11-silentrg0002
status: experimental
description: Detects execution of rclone or renamed equivalents with copy/move/sync flags targeting cloud remotes. SILENTRANSOMGROUP stages stolen data (legal, HR, financial records) into archives and exfiltrates to MEGA and similar cloud storage using rclone, frequently renamed to evade detection (e.g., svchost-update.exe, winupdate.exe).
author: Security Arsenal Threat Intelligence
date: 2026/08/28
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    CommandLine|contains:
      - ' copy '
      - ' sync '
      - ' move '
  selection_remote:
    CommandLine|contains:
      - 'mega:'
      - ':mega'
      - 'dropbox:'
      - 'gdrive:'
      - 'pcloud:'
      - '--config'
      - '--transfers'
      - '--bwlimit'
  selection_image:
    - OriginalFileName: 'rclone.exe'
    - Image|endswith: '\rclone.exe'
  condition: selection_cmd and selection_remote and selection_image
falsepositives:
  - Legitimate backup pipelines using rclone. Allowlist known backup service accounts and scheduled task contexts.
level: critical
tags:
  - attack.exfiltration
  - attack.t1567.002
---
title: Pre-Extortion Discovery and Staging - Sensitive Directory Enumeration
description: Detects rapid enumeration of directories associated with high-value extortion data (legal, HR, payroll, finance, contracts) followed by archive creation, consistent with SILENTRANSOMGROUP's selective data-theft methodology prior to leak-site publication.
id: 7c1a9f2e-4b3d-4e5a-9f11-silentrg0003
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/08/28
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_tree:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\tree.com'
    CommandLine|contains:
      - 'Legal'
      - 'Payroll'
      - 'HR'
      - 'Contracts'
      - 'Finance'
      - 'Confidential'
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -p'
  condition: selection_tree or selection_archive
falsepositives:
  - IT backup/archival jobs. Correlate with account type and time of day; extortion actors typically operate outside business hours in victim local time.
level: medium
tags:
  - attack.discovery
  - attack.t1083
  - attack.collection
  - attack.t1560.001

Microsoft Sentinel — hunt query: pre-extortion staging & RMM-driven lateral movement

// SILENTRANSOMGROUP hunt: RMM execution + data staging + exfil correlation (7d)
// Looks for hosts where remote-access tooling appeared AND archive/cloud-exfil
// behavior occurred within a 6-hour window — the group's typical theft session.
let lookback = 7d;
let rmmBins = dynamic(["ScreenConnect","AnyDesk","ZohoAssist","Splashtop","AteraAgent","Syncro","TeamViewer"]);
let rmmEvents = DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName has_any (rmmBins) or ProcessCommandLine has_any (rmmBins)
    | summarize RMMFirstSeen=min(TimeGenerated), RMMCommands=make_set(ProcessCommandLine, 20)
        by DeviceName, InitiatingProcessAccountName;
let stagingEvents = DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where (FileName in~ ("7z.exe","7za.exe","rar.exe","rclone.exe","winscp.exe","filezilla.exe"))
         or (ProcessCommandLine has_any ("mega:","--transfers","--bwlimit",".mega.co.nz","rclone"))
    | summarize StageFirstSeen=min(TimeGenerated), StageCmds=make_set(ProcessCommandLine, 20)
        by DeviceName, InitiatingProcessAccountName;
rmmEvents
| join kind=inner stagingEvents on DeviceName
| where abs(datetime_diff('minute', StageFirstSeen, RMMFirstSeen)) <= 360
| extend SessionGapMinutes = abs(datetime_diff('minute', StageFirstSeen, RMMFirstSeen))
| project DeviceName, InitiatingProcessAccountName, RMMFirstSeen, StageFirstSeen,
          SessionGapMinutes, RMMCommands, StageCmds
| order by StageFirstSeen asc;

Rapid-response PowerShell: audit rogue RMM, recent scheduled tasks, and shadow copy tampering

# Security Arsenal - SILENTRANSOMGROUP Rapid Triage (run elevated, per host or via EDR remote shell)
# 1) Rogue RMM binaries in user-writable paths
$rmm = 'ScreenConnect','AnyDesk','ZohoAssist','Splashtop','AteraAgent','Syncro','TeamViewer','rclone'
Write-Host "=== [1] RMM/exfil binaries in suspicious paths ===" -ForegroundColor Cyan
Get-CimInstance Win32_Process | Where-Object {
    $p = $_.ExecutablePath
    $p -and ($rmm | Where-Object { $p -match $_ }) -and
    ($p -match 'Users\\|AppData|Temp|Downloads|ProgramData')
} | Select-Object ProcessId, Name, ExecutablePath, @{n='CmdLine';e={$_.CommandLine}} | Format-List

# 2) Scheduled tasks created in last 7 days (persistence)
Write-Host "=== [2] Scheduled tasks created/modified in last 7 days ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) } |
    Select-Object TaskName, TaskPath, Date, @{n='Action';e={($_.Actions | ForEach-Object { $_.Execute + ' ' + $_.Arguments }) -join '; '}} | Format-List

# 3) Volume Shadow Copy tampering (defense evasion / anti-recovery)
Write-Host "=== [3] Shadow copy status ===" -ForegroundColor Cyan
vssadmin list shadows 2>$null | Select-String 'Shadow Copy','Creation time'
Get-WinEvent -FilterHashtable @{LogName='System'; Id=410, 7040; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'VSS|Volume Shadow' } | Select-Object TimeCreated, Id, Message | Format-List

# 4) Recent outbound connections to consumer cloud storage (exfil indicator)
Write-Host "=== [4] Active connections to exfil-friendly cloud hosts ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemotePort -in 443, 80 } |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        [PSCustomObject]@{ Process=$proc.ProcessName; Path=$proc.Path; RemoteIP=$_.RemoteAddress; Port=$_.RemotePort }
    } | Where-Object { $_.Path -match 'rclone|Users\\|AppData' } | Format-Table -AutoSize
Write-Host "=== Triage complete. Escalate any hits to IR immediately. ===" -ForegroundColor Green

4. Incident Response Priorities (SILENTRANSOMGROUP-specific playbook)

4.1 T-minus detection checklist — what fires BEFORE the leak post

Because encryption may never occur, "before detonation" for this group means before the data leaves:

• Unexpected outbound volume spike to consumer cloud storage (MEGA, Dropbox, pCloud) — especially outside business hours
• New RMM agent appearing in software inventory or on hosts outside the IT-managed fleet
• Inbound calls to staff referencing "invoices," "refunds," or "subscription cancellations" followed by requests to install software (callback phishing — brief your helpdesk NOW)
• Archive utility execution (7z/rar) on file servers hosting legal/HR/finance shares
• Exchange mailbox export requests (New-MailboxExportRequest) or unusual eDiscovery activity
• Authentication anomalies on Check Point/VPN gateways: IKEv1 negotiation failures followed by successful admin sessions (CVE-2026-50751 probing)
• New local admin accounts or RDP enablement on endpoints with no change ticket

4.2 Critical assets this group prioritizes for exfiltration

1. Legal/contracts — M&A documents, litigation files, NDAs (highest extortion leverage)
2. HR/PII — employee records, payroll, SSN/national ID data (regulatory pressure multiplier)
3. Financial records — audits, tax filings, banking details
4. Executive email — Exchange mailboxes of C-suite and legal counsel (negotiation intelligence)
5. Client/customer databases — enables secondary extortion of the victim's own clients

4.3 Containment actions — ordered by urgency

1. Block exfil channels first (not last): egress-filter MEGA/Dropbox/pCloud/WeTransfer at the proxy and firewall. For an exfil-only actor, this IS the kill chain.
2. Kill all unauthorized RMM sessions; revoke credentials of any account observed using them; hunt for persistence the RMM session may have created.
3. Disable and audit VPN gateway admin access; force credential rotation for all VPN-authenticated admins; check IKEv1 logs for exploitation attempts.
4. Isolate staging hosts (file servers, Exchange) — but preserve memory and network flow logs before shutdown; attribution and scope depend on it.
5. Rotate domain admin and service account credentials enterprise-wide (assume Kerberos theft if RMM had admin context).
6. Engage counsel and IR retainer immediately — extortion-only incidents still trigger breach notification obligations in most jurisdictions once PII exfiltration is confirmed.
7. Do NOT attempt direct contact with the actor or access their leak site from corporate infrastructure.

5. Hardening Recommendations

Immediate (next 24 hours)

• Patch or mitigate Check Point Security Gateways against CVE-2026-50751 (disable IKEv1 where VPN peers permit; apply vendor hotfix). This is the highest-likelihood perimeter entry point in the current KEV set.
• Audit every ConnectWise ScreenConnect instance: patch CVE-2024-1708, then inventory for unauthorized installs — ScreenConnect is both exploit target and attacker tool.
• Egress-block consumer cloud storage (MEGA, Dropbox, pCloud, WeTransfer, file.io) absent a documented business need. Alert on attempted connections.
• AppLocker/WDAC policy: block execution of rclone, 7z, rar from user-writable directories; block all RMM binaries not on an explicit allowlist.
• Helpdesk/executive-assistant briefing on callback phishing: any unsolicited caller directing software installation is an incident — report, don't comply.

Short-term (2 weeks)

• Patch Exchange (CVE-2023-21529) and Windows link-following (CVE-2025-60710) across the fleet; prioritize internet-adjacent and mailbox servers.
• Deploy the Sigma rules and Sentinel hunt above; run the triage script across file servers and any host that has held an admin session in the past 30 days.
• Data egress architecture: implement DLP or CASB controls with alerting on bulk reads from legal/HR/finance shares by any single account (>1 GB in 24h is a good starting threshold).
• Network segmentation: isolate file servers and Exchange from general endpoint VLANs; require jump-host access with just-in-time admin credentials.
• Deception: plant canary documents in high-value shares with beacon metadata — exfil-only actors will take them, and the callback gives you detection no EDR rule will.
• Establish an extortion-response playbook distinct from your ransomware playbook: legal notification thresholds, PR holding statements, and negotiation-decision authority mapped in advance.

This briefing is based on live dark web monitoring current as of 2026-08-28. Victim identities remain partially redacted on the source leak site; Security Arsenal will update this bulletin as full attribution and sector data emerge. If your organization appears on this group's leak site, engage incident response before the publication escalation window (typically 7–14 days) closes.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub