Silent Skimmer Gets Loud (Again)
Summary: In late May 2024, Unit 42 observed an adversary compromising multiple web servers to reach the environment of a North American multinational, exploiting two one-day Telerik UI vulnerabilities that allow remote code execution on older versions. The activity is attributed to the financially motivated actor behind Silent Skimmer, first uncovered in September 2023, and is tracked as CL-CRI-0941; this time the actor used a compiled Python script with hard-coded credentials to connect to a database and dump payment information to a CSV file.
Why it matters: The group's entry point was Telerik UI vulnerabilities over five years old, and its new exfiltration method skips the web page entirely by querying the payment database directly with hard-coded credentials - so page-level scraping defenses would not see it.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026