Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Silent Librarian · Unknown · assessed origin Iran · misp-galaxy + mitre-attack · refreshed 2026-10-06

Silent Librarian

  • COBALT DICKENS
  • Mabna Institute
  • TA407
  • TA4900
  • Yellow Nabu
  • Mabna Institute Group

MITRE G0122 ↗

Silent Librarian — ATT&CK roseSL

attack rose · 13 techniques across 5 tactics

Last 30 days

last seen 15 d ago
dispatch1
victims0
CVEs seen0

What changed

ledger · newest first
  1. —14 d agoresurfacedback on the wire — nothing in the previous 30 days

Analyst brief

misp-galaxy + mitre-attack

Last Friday, Deputy Attorney General Rod Rosenstein announced the indictment of nine Iranians who worked for an organization named the Mabna Institute. According to prosecutors, the defendants stole more than 31 terabytes of data from universities, companies, and government agencies around the world. 4 billion.

The information stolen from these universities was used by the Islamic Revolutionary Guard Corps (IRGC) or sold for profit inside Iran. PhishLabs has been tracking this same threat group since late-2017, designating them Silent Librarian. Since discovery, we have been working with the FBI, ISAC partners, and other international law enforcement agencies to help understand and mitigate these attacks.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

13 techniques · 5 of 15 tactics

  1. Reconnaissance

    4 techniques

  2. Resource development

    5 techniques

  3. Stealth

    1 technique

  4. Credential access

    1 technique

  5. Collection

    2 techniques

select a technique

Take it with you

keyless · no signup

References

14 sources
  1. 1.info.phishlabs.com/blog/silent-librarian-more-to-the-story-of-the-iranian…
  2. 2.info.phishlabs.com/blog/silent-librarian-university-attacks-continue-unab…
  3. 3.justice.gov/usao-sdny/pr/nine-iranians-charged-conducting-massive-…
  4. 4.justice.gov/opa/pr/nine-iranians-charged-conducting-massive-cyber-…
  5. 5.secureworks.com/blog/cobalt-dickens-goes-back-to-school-again
  6. 6.secureworks.com/blog/back-to-school-cobalt-dickens-targets-universities
  7. 7.proofpoint.com/us/threat-insight/post/seems-phishy-back-school-lures-…
  8. 8.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-sile…
  9. 9.secureworks.com/research/threat-profiles/cobalt-dickens
  10. 10.community.riskiq.com/article/44eb0802
  11. +4 more in the JSON record

Track Silent Librarian on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.