Silent Rotor - Environment Variable Exfiltration Base (T1082)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•1

Correlates the targeted reading of USERDNSDOMAIN and COMPUTERNAME environment variables with network connections to a known malicious domain (kleymarket.ru), indicating potential data exfiltration by the Silent Rotor malware.