Introduction
Silent Librarian is a group that has targeted research and proprietary data at universities, government agencies, and private sector companies worldwide since at least 2013. Members of Silent Librarian are known to have been affiliated with the Iran-based Mabna Institute which has conducted cyber intrusions at the behest of the government of Iran, specifically the Islamic Revolutionary Guard Corps (IRGC). DOJ Iran Indictments March 2018 Phish Labs Silent Librarian Malwarebytes Silent Librarian October 2020
Activities and Tactics
Country of Origin: 🇮🇷 Iran
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1588.004 Digital Certificates
- T1594 Search Victim-Owned Websites
- T1114 Email Collection
- T1598.003 Spearphishing Link
- T1589.003 Employee Names
- T1114.003 Email Forwarding Rule
- T1585.002 Email Accounts
- T1589.002 Email Addresses
- T1608.005 Link Target
- T1110.003 Password Spraying
- T1583.001 Domains
- T1588.002 Tool
- T1078 Valid Accounts
ATT&CK technique IDs (denormalized)
- T1078
- T1110.003
- T1114
- T1114.003
- T1583.001
- T1585.002
- T1588.002
- T1588.004
- T1589.002
- T1589.003
- T1594
- T1598.003
- T1608.005
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- CyberGate:
- Cyber Eye RAT:
Attribution and Evidence
Country of Origin: Iran Additional attribution information pending cataloguing.
References
[1] mitre-attack [4] DOJ Iran Indictments March 2018 DOJ. (2018, March 23). U.S. v. Rafatnejad et al . Retrieved February 3, 2021. [5] Phish Labs Silent Librarian Hassold, Crane. (2018, March 26). Silent Librarian: More to the Story of the Iranian Mabna Institute Indictment. Retrieved February 3, 2021. [6] Malwarebytes Silent Librarian October 2020 Malwarebytes Threat Intelligence Team. (2020, October 14). Silent Librarian APT right on schedule for 20/21 academic year. Retrieved February 3, 2021. [7] Proofpoint TA407 September 2019 Proofpoint Threat Insight Team. (2019, September 5). Threat Actor Profile: TA407, the Silent Librarian. Retrieved February 3, 2021. [8] Secureworks COBALT DICKENS August 2018 Counter Threat Unit Research Team. (2018, August 24). Back to School: COBALT DICKENS Targets Universities. Retrieved February 3, 2021. [9] Secureworks COBALT DICKENS September 2019 Counter Threat Unit Research Team. (2019, September 11). COBALT DICKENS Goes Back to School…Again. Retrieved February 3, 2021.