- Category
- State · Attributed to a state or working for one.
- Origin
- Iran(high confidence)
- Sponsor
- State-sponsored, Islamic Revolutionary Guard Corps
- Agency named
- IRGC, Islamic Revolutionary Guard Corps
- Motivation
- Information theft and espionage
- Seen
- 2013–2026
- Status
- Active
- ATT&CK
- G0122 · 13 techniques
- Sources
- 10 sources carry it
- Identifier
- GINC-APT-0070 · silent-librarian
IranWhat it is
Silent Librarian is a group that has targeted research and proprietary data at universities, government agencies, and private sector companies worldwide since at least 2013. Members of Silent Librarian are known to have been affiliated with the Iran-based Mabna Institute which has conducted cyber intrusions at the behest of the government of Iran, specifically the Islamic Revolutionary Guard Corps (IRGC).
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Scholar Kitten
- IBM X-Force
- ITG22
- Microsoft
- DEV-0118
- MITRE ATT&CK
- G0122
- Proofpoint
- TA407, TA4900
- Secureworks
- COBALT DICKENS
- Other names
- Mabna Institute, Academic Serpens, Mabna Institute Group, Mabna Institute, Cobalt Dickens, Silent Librarian, SilentLibrarian, Yellow Nabu
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTIran
- MISP Galaxy (CFR tagging)Iran
- ThreatActor.info (Malpedia et al.)Iran · high
Targets
- Countries
- Australia, Canada, China, Hong Kong, Israel, Japan, Switzerland, Türkiye, United Kingdom, United States
- Sectors
- Education
Tools
The tools and malware families the sources tie to it.
- Cyber Eye RAT
- CyberGate
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de