Silent Librarian
MISPUnknown
IR
Unknown
Last Friday, Deputy Attorney General Rod Rosenstein announced the indictment of nine Iranians who worked for an organization named the Mabna Institute. According to prosecutors, the defendants stole more than 31 terabytes of data from universities, companies, and government agencies around the world. The cost to the universities alone reportedly amounted to approximately $3.4 billion. The information stolen from these universities was used by the Islamic Revolutionary Guard Corps (IRGC) or sold for profit inside Iran. PhishLabs has been tracking this same threat group since late-2017, designating them Silent Librarian. Since discovery, we have been working with the FBI, ISAC partners, and other international law enforcement agencies to help understand and mitigate these attacks.
Tecniche Utilizzate (13)
| ID | ATT&CK | Tattiche |
|---|---|---|
| T1078 | Valid Accounts | - |
| T1110.003 | Password Spraying | - |
| T1114 | Email Collection | - |
| T1114.003 | Email Forwarding Rule | - |
| T1583.001 | Domains | - |
| T1585.002 | Email Accounts | - |
| T1588.002 | Tool | - |
| T1588.004 | Digital Certificates | - |
| T1589.002 | Email Addresses | - |
| T1589.003 | Employee Names | - |
| T1594 | Search Victim-Owned Websites | - |
| T1598.003 | Spearphishing Link | - |
| T1608.005 | Link Target | - |
Riferimenti (10)
- info.phishlabs.com - Silent Librarian More To The Story Of The Iranian Mabna Institute Indictment
- info.phishlabs.com - Silent Librarian University Attacks Continue Unabated In Days Following Indictment
- justice.gov - Nine Iranians Charged Conducting Massive Cyber Theft Campaign Behalf Islamic
- justice.gov - Nine Iranians Charged Conducting Massive Cyber Theft Campaign Behalf Islamic Revolutionary
- secureworks.com - Cobalt Dickens Goes Back To School Again
- secureworks.com - Back To School Cobalt Dickens Targets Universities
- proofpoint.com - Seems Phishy Back School Lures Target University Students And Staff
- proofpoint.com - Threat Actor Profile Ta407 Silent Librarian
- secureworks.com - Cobalt Dickens
- community.riskiq.com - 44eb0802
Alias (735)
Metadata
| ID: | 227 |
| Created: | 13/01/2026 17:48 |
| Updated: | 07/03/2026 04:00 |