Silent Librarian is a group that has targeted research and proprietary data at universities, government agencies, and private sector companies worldwide since at least 2013. Members of Silent Librarian are known to have been affiliated with the Iran-based Mabna Institute which has conducted cyber intrusions at the behest of the government of Iran, specifically the Islamic Revolutionary Guard Corps (IRGC).123
- DOJ Iran Indictments March 2018
- Phish Labs Silent Librarian
- Malwarebytes Silent Librarian October 2020
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1588.004 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1594 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2021 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1078 | Valid Accounts | — |
| T1110.003 | Password Spraying | — |
| T1114 | Email Collection | — |
| T1114.003 | Email Forwarding Rule | — |
| T1583.001 | Domains | — |
| T1585.002 | Email Accounts | — |
| T1588.002 | Tool | — |
| T1588.004 | Digital Certificates | — |
| T1589.002 | Email Addresses | — |
| T1589.003 | Employee Names | — |
| T1594 | Search Victim-Owned Websites | — |
| T1598.003 | Spearphishing Link | — |
| T1608.005 | Link Target | — |
Aliases
COBALT DICKENS · Silent Librarian · TA407
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.