What tactics and techniques does SilverTerrier use?

How SilverTerrier Gets In

SilverTerrier is best understood as a financially motivated email-abuse campaign: it relies on social engineering first, then uses access gained through message deception to move into payment fraud. The core tactic is to make a message look legitimate enough that the target takes the next step without verifying the request through a separate channel.

That matters because the group’s success depends less on technical exploitation than on convincing a recipient to trust a forged business interaction. In practice, the attacker often uses spoofed or lookalike sender details, urgent payment language, and realistic invoice or remit-now prompts to create a believable pretext.

When the lure works, the attacker can capture credentials, redirect funds, or obtain mailbox access that becomes a launch point for further abuse. That is why Top 10 Phishing Techniques is the most useful lens for understanding the delivery side of the campaign: BEC, invoice fraud, and mailbox compromise are all part of the same social-engineering chain.

What SilverTerrier Tries to Do After Initial Contact

Once a target engages, the objective usually shifts from deception to control. SilverTerrier commonly aims to harvest credentials, access mailboxes, and maintain enough visibility into conversations to insert itself into payment threads or redirect follow-up exchanges. That turns a single successful message into a broader business-process compromise.

Mailbox access is especially valuable because it lets the attacker observe legitimate correspondence, copy writing style, and time the fraud around real transactions. It can also expose contact lists, invoice histories, and internal approval patterns that make later messages harder to spot. In that sense, the mailbox is not just a target, it is an operational foothold.

The campaign’s tradecraft fits the broader adversary patterns documented in MITRE ATT&CK Enterprise Matrix, especially credential access and follow-on abuse of legitimate access paths. For defenders, the important point is that the attack often looks routine until the payment flow or mailbox behaviour changes.

Why the Same Techniques Keep Working

SilverTerrier succeeds because it targets ordinary business friction: invoice handling, payment approval, and fast-moving email workflows. Attackers do not need to break encryption or exploit a software flaw if they can persuade someone to accept a believable payment change or sign in to a fake page.

The most common failure modes are weak sender verification, overreliance on email alone for payment instructions, and limited monitoring of mailbox rules and forwarding changes. Once an attacker can alter message flow or impersonate a trusted contact, the fraud path becomes much easier to sustain. Those behaviors align with established phishing and credential-theft patterns rather than a one-off trick.

For a practical control mapping, the same behaviours are well represented in MITRE ATT&CK Enterprise Matrix, while message-level deception and payment redirection are the core mechanics described by the campaign’s phishing profile. The strongest sign is usually not a single suspicious email, but a change in who is asking for payment and how the request is being routed.

Practitioner Guidance

What to prioritise: Treat payment-request validation and mailbox monitoring as the same investigation stream. If a finance workflow depends on email-only approval, the attacker does not need deep access, just one convincing message and a weak out-of-band verification habit.

What to verify: Check for sender-domain lookalikes, newly created inbox rules, unusual forwarding, unusual login locations, and any request to change bank details or payment destination. If mailbox access is confirmed, review whether the attacker may have seen prior invoices, signature blocks, or approval chains that could support a second-stage fraud attempt.

Practitioner takeaway: SilverTerrier is less about a single exploit than about turning trusted email relationships into a payment-control bypass, so the best defence is to verify requests outside the mailbox and treat mailbox abuse as a fraud-enablement event, not just an email incident.

Related resources from NHI Mgmt Group

• Guide: Threat Actor Groups Guide
• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?