MITRE ATT&CKgroup
G0122 Silent Librarian
- Domain
- enterprise
- Aliases
- TA407, COBALT DICKENS
- Version
- 1.0
- Created
- 2021-02-03
Description
Silent Librarian is a group that has targeted research and proprietary data at universities, government agencies, and private sector companies worldwide since at least 2013. Members of Silent Librarian are known to have been affiliated with the Iran-based Mabna Institute which has conducted cyber intrusions at the behest of the government of Iran, specifically the Islamic Revolutionary Guard Corps (IRGC).
Related
Uses · MITRE ATT&CK (13)
- T1608.005 Link Target sub-technique
- T1589.002 Email Addresses sub-technique
- T1589.003 Employee Names sub-technique
- T1594 Search Victim-Owned Websites technique
- T1598.003 Spearphishing Link sub-technique
- T1585.002 Email Accounts sub-technique
- T1588.002 Tool sub-technique
- T1588.004 Digital Certificates sub-technique
- T1583.001 Domains sub-technique
- T1114.003 Email Forwarding Rule sub-technique
- T1110.003 Password Spraying sub-technique
- T1078 Valid Accounts technique
- T1114 Email Collection technique
References
- https://www.justice.gov/usao-sdny/press-release/file/1045781/download DOJ Iran Indictments March 2018
- https://info.phishlabs.com/blog/silent-librarian-more-to-the-story-of-the-iranian-mabna-institute-indictment Phish Labs Silent Librarian
- https://blog.malwarebytes.com/malwarebytes-news/2020/10/silent-librarian-apt-phishing-attack/ Malwarebytes Silent Librarian October 2020
- https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian Proofpoint TA407 September 2019
- https://www.secureworks.com/blog/back-to-school-cobalt-dickens-targets-universities Secureworks COBALT DICKENS August 2018
- https://www.secureworks.com/blog/cobalt-dickens-goes-back-to-school-again Secureworks COBALT DICKENS September 2019