Actor Profile

Silent Swap is an active cybercrime campaign leveraging malicious browser extensions to conduct cryptocurrency theft. The operation distributes unsigned installers written in both .NET and Golang variants, masquerading as a legitimate Google Notes browser extension. The actor's primary motivation is financial gain through the interception and manipulation of cryptocurrency transactions. The campaign demonstrates technical sophistication in its use of multiple programming languages and social engineering tactics to compromise victims' cryptocurrency wallets by performing address substitution attacks during transaction processes.

TTPs (Tactics, Techniques, Procedures)

The Silent Swap campaign employs browser extension-based malware for initial access and persistence (T1176 - Browser Extensions). The malware performs clipboard manipulation to replace cryptocurrency wallet addresses during transactions, consistent with T1565.002 (Transmitted Data Manipulation). Distribution occurs via unsigned installers, suggesting T1036.005 (Masquerading: Match Legitimate Name or Location) by impersonating Google Notes. The use of multiple programming languages (.NET and Golang) for malware variants indicates operational flexibility and potential evasion capabilities (T1027 - Obfuscated Files or Information). The core attack mechanism involves monitoring and intercepting financial transactions to redirect cryptocurrency to attacker-controlled wallets.

Targets & Patterns

Silent Swap specifically targets individuals and organizations within the financial services and cryptocurrency sectors. The campaign focuses on users conducting cryptocurrency transactions, exploiting the irreversible nature of blockchain transfers to maximize impact. By disguising malware as a productivity tool (Google Notes extension), the actor targets users who may install browser extensions without rigorous security vetting. The choice of cryptocurrency-focused victims aligns with the campaign's financial motivation, as successful wallet address substitution results in immediate, untraceable monetary gain. The broad targeting within the cryptocurrency ecosystem suggests opportunistic victim selection rather than highly targeted operations against specific entities.

Historical Context

The Silent Swap campaign represents an evolution in cryptocurrency theft techniques, building upon established clipper malware tactics that have been observed since at least 2017. Browser extension-based attacks targeting cryptocurrency users have increased in prevalence as digital asset adoption has grown. The use of unsigned installers and masquerading as legitimate Google services follows patterns seen in previous financially-motivated campaigns. However, specific historical connections to known threat actors or previous Silent Swap operations cannot be established from the available data. The dual-language implementation (.NET and Golang) may indicate either a single actor's technical evolution or potential code sharing among cybercrime groups, though attribution to established groups remains unconfirmed.

Defensive Recommendations

  • Implement browser extension allowlisting policies and prohibit installation of unsigned or unverified extensions, particularly in environments handling cryptocurrency transactions
  • Monitor for T1176 (Browser Extensions) by auditing installed extensions regularly and detecting unauthorized additions through endpoint detection tools
  • Deploy clipboard monitoring solutions to detect T1565.002 (Transmitted Data Manipulation) by flagging unexpected modifications to cryptocurrency wallet addresses
  • Educate users on verifying wallet addresses through multiple channels before confirming cryptocurrency transactions, and implement transaction verification workflows that display addresses from multiple sources
  • Detect unsigned executable execution (T1027) by enabling application control policies and logging execution of .NET and Golang binaries from non-standard locations