Loading threat actor…
Silent Librarian, tracked as TA407 and commonly known as Cobalt Dickens, is an Iran-based threat actor associated with the Mabna Institute. Active since at least 2013, it primarily targets universities and higher education institutions worldwide, particularly in the United States, North America, and Europe, to steal academic research, intellectual property, and access to subscription resources. Its operations combine commercial resale of stolen information with support for Iranian government interests. U.S. authorities linked Mabna Institute operations to Iran’s Islamic Revolutionary Guard Corps and indicted nine associated Iranian nationals in March 2018. The group continued conducting phishing campaigns after those indictments. Silent Librarian specializes in low-volume, highly personalized spearphishing that impersonates university library administrators. Lures commonly warn of overdue materials or impending loss of library access and direct recipients to cloned institutional authentication portals. The group copies legitimate login pages with publicly available tools, including SingleFile and HTTrack, and uses lookalike domains, stolen branding, fabricated signatures, and university-specific details. It adapts phishing pages and messages to changes in target portals and local events, sometimes timing campaigns for periods of reduced security staffing. The group uses harvested credentials to access university accounts and academic resources, steal proprietary information, and send phishing messages from compromised institutions to users at other universities. It abuses legitimate URL-shortening services and institutional infrastructure to obscure phishing destinations. Additional documented behaviors include password spraying against private-sector targets and establishing attacker-controlled email accounts to receive messages forwarded from compromised mailboxes. Victims associated with the broader Mabna Institute campaign also included government agencies, private companies, and international nongovernmental organizations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
28 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
100 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as an associated threat actor in the detection annotation for a Linux usermod root UID set analytic; no specific campaign or activity is described in this reference.
Listed as a threat actor associated with Azure Active Directory account takeover, persistence, privilege escalation, and related cloud-focused post-compromise activity detected via PowerShell module installation.
Listed as a threat actor associated with the Valid Accounts technique in the context of AWS SAML provider update detection and potential federated credential abuse.
Listed as a threat actor associated with the detection's ATT&CK-style annotations for valid accounts and alternate authentication material activity.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.