Silent Skimmer Gets Loud (Again)

Unit 42 observed a resurgence of the Silent Skimmer campaign in May 2024 where adversaries exploited one-day Telerik UI vulnerabilities to compromise web servers, install web shells and reverse shells, escalate privileges with GodPotato, and use loaders (RingQ) and Cobalt Strike to dump payment data; the attackers used a PyInstaller-compiled Python binary to query and exfiltrate payment records. The report provides detailed TTP analysis (including mixed-mode .NET assembly evasion and reverse-proxy tunneling), a long list of IOCs (hashes, IPs, domains, URLs), XQL detection queries, and mitigation recommendations including patching and defensive products.