1. Home
  2. Groups
  3. Silent Librarian

Silent Librarian

Silent Librarian is a group that has targeted research and proprietary data at universities, government agencies, and private sector companies worldwide since at least 2013. Members of Silent Librarian are known to have been affiliated with the Iran-based Mabna Institute which has conducted cyber intrusions at the behest of the government of Iran, specifically the Islamic Revolutionary Guard Corps (IRGC).[1][2][3]

ID: G0122
ⓘ
Associated Groups: TA407, COBALT DICKENS
Version: 1.0
Created: 03 February 2021
Last Modified: 21 April 2021

Associated Group Descriptions

Name Description
TA407

[4][3]
COBALT DICKENS

[5][6][4][3]
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1583 .001 Acquire Infrastructure: Domains

Silent Librarian has acquired domains to establish credential harvesting pages, often spoofing the target organization and using free top level domains .TK, .ML, .GA, .CF, and .GQ.[1][2][5][4][6][3]
Enterprise T1110 .003 Brute Force: Password Spraying

Silent Librarian has used collected lists of names and e-mail accounts to use in password spraying attacks against private sector targets.[1]
Enterprise T1114 Email Collection

Silent Librarian has exfiltrated entire mailboxes from compromised accounts.[1]
.003 Email Forwarding Rule

Silent Librarian has set up auto forwarding rules on compromised e-mail accounts.[1]
Enterprise T1585 .002 Establish Accounts: Email Accounts

Silent Librarian has established e-mail accounts to receive e-mails forwarded from compromised accounts.[1]
Enterprise T1589 .002 Gather Victim Identity Information: Email Addresses

Silent Librarian has collected e-mail addresses from targeted organizations from open Internet searches.[1]
.003 Gather Victim Identity Information: Employee Names

Silent Librarian has collected lists of names for individuals from targeted organizations.[1]
Enterprise T1588 .002 Obtain Capabilities: Tool

Silent Librarian has obtained free and publicly available tools including SingleFile and HTTrack to copy login pages of targeted organizations.[4][6]
.004 Obtain Capabilities: Digital Certificates

Silent Librarian has obtained free Let's Encrypt SSL certificates for use on their phishing pages.[2][6]
Enterprise T1598 .003 Phishing for Information: Spearphishing Link

Silent Librarian has used links in e-mails to direct victims to credential harvesting websites designed to appear like the targeted organization's login page.[1][2][5][4][6][3]
Enterprise T1594 Search Victim-Owned Websites

Silent Librarian has searched victim's websites to identify the interests and academic areas of targeted individuals and to scrape source code, branding, and organizational contact information for phishing pages.[1][2][4]
Enterprise T1608 .005 Stage Capabilities: Link Target

Silent Librarian has cloned victim organization login pages and staged them for later use in credential harvesting campaigns. Silent Librarian has also made use of a variety of URL shorteners for these staged websites.[6][3][4]
Enterprise T1078 Valid Accounts

Silent Librarian has used compromised credentials to obtain unauthorized access to online accounts.[1]

References

  1. DOJ. (2018, March 23). U.S. v. Rafatnejad et al . Retrieved February 3, 2021.
  2. Hassold, Crane. (2018, March 26). Silent Librarian: More to the Story of the Iranian Mabna Institute Indictment. Retrieved February 3, 2021.
  3. Malwarebytes Threat Intelligence Team. (2020, October 14). Silent Librarian APT right on schedule for 20/21 academic year. Retrieved February 3, 2021.
  1. Proofpoint Threat Insight Team. (2019, September 5). Threat Actor Profile: TA407, the Silent Librarian. Retrieved February 3, 2021.
  2. Counter Threat Unit Research Team. (2018, August 24). Back to School: COBALT DICKENS Targets Universities. Retrieved February 3, 2021.
  3. Counter Threat Unit Research Team. (2019, September 11). COBALT DICKENS Goes Back to School…Again. Retrieved February 3, 2021.