type: intrusion-set
spec_version: 2.1
id: intrusion-set--90784c1e-4aba-40eb-9adf-7556235e6384
created: 2021-02-03T16:36:38.145Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0122
external_id: G0122
source_name: TA407
description: (Citation: Proofpoint TA407 September 2019)(Citation: Malwarebytes Silent Librarian October 2020)
source_name: COBALT DICKENS
description: (Citation: Secureworks COBALT DICKENS August 2018)(Citation: Secureworks COBALT DICKENS September 2019)(Citation: Proofpoint TA407 September 2019)(Citation: Malwarebytes Silent Librarian October 2020)
source_name: DOJ Iran Indictments March 2018
description: DOJ. (2018, March 23). U.S. v. Rafatnejad et al . Retrieved February 3, 2021.
url: https://www.justice.gov/usao-sdny/press-release/file/1045781/download
source_name: Phish Labs Silent Librarian
description: Hassold, Crane. (2018, March 26). Silent Librarian: More to the Story of the Iranian Mabna Institute Indictment. Retrieved February 3, 2021.
url: https://info.phishlabs.com/blog/silent-librarian-more-to-the-story-of-the-iranian-mabna-institute-indictment
source_name: Malwarebytes Silent Librarian October 2020
description: Malwarebytes Threat Intelligence Team. (2020, October 14). Silent Librarian APT right on schedule for 20/21 academic year. Retrieved February 3, 2021.
url: https://blog.malwarebytes.com/malwarebytes-news/2020/10/silent-librarian-apt-phishing-attack/
source_name: Proofpoint TA407 September 2019
description: Proofpoint Threat Insight Team. (2019, September 5). Threat Actor Profile: TA407, the Silent Librarian. Retrieved February 3, 2021.
url: https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian
source_name: Secureworks COBALT DICKENS August 2018
description: Counter Threat Unit Research Team. (2018, August 24). Back to School: COBALT DICKENS Targets Universities. Retrieved February 3, 2021.
url: https://www.secureworks.com/blog/back-to-school-cobalt-dickens-targets-universities
source_name: Secureworks COBALT DICKENS September 2019
description: Counter Threat Unit Research Team. (2019, September 11). COBALT DICKENS Goes Back to School…Again. Retrieved February 3, 2021.
url: https://www.secureworks.com/blog/cobalt-dickens-goes-back-to-school-again
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:29.613Z
name: Silent Librarian
description: [Silent Librarian](https://attack.mitre.org/groups/G0122) is a group that has targeted research and proprietary data at universities, government agencies, and private sector companies worldwide since at least 2013. Members of [Silent Librarian](https://attack.mitre.org/groups/G0122) are known to have been affiliated with the Iran-based Mabna Institute which has conducted cyber intrusions at the behest of the government of Iran, specifically the Islamic Revolutionary Guard Corps (IRGC).(Citation: DOJ Iran Indictments March 2018)(Citation: Phish Labs Silent Librarian)(Citation: Malwarebytes Silent Librarian October 2020)
aliases: Silent Librarian
TA407
COBALT DICKENS
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0