silentransomgroup

T1078Valid Accounts

Threat actors may leverage victim credentials to access email or cloud services

T1566Phishing

Callback phishing emails using invoice, billing, subscription, or IT-themed lures

T1530Data from Cloud Storage

Theft of data from Microsoft 365, OneDrive, Google Drive, or similar platforms

T1560Archive Collected Data

Data may be staged or compressed prior to exfiltration

T1052.001Exfiltration over USB

In-person intrusion scenarios involving USB or external hard drive data theft

T1567Exfiltration Over Web Service

Upload of stolen data to cloud storage or web-accessible platforms

T1219Remote Access Tools

Legitimate remote administration tools used to establish interactive access

T1657Financial Theft

Threatened publication or sale of stolen victim data

T1598.004Spearphishing Voice

Threat actors direct victims to initiate phone contact or impersonate internal IT support