CVE Intelligence
Home / Threat actors / Silent Librarian

Silent Librarian G0122

🔔 Create alert

Also known as: TA407, COBALT DICKENS

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0
associated CVEs
16
Techniques
0
Malware and tools

Silent Librarian is a group that has targeted research and proprietary data at universities, government agencies, and private sector companies worldwide since at least 2013. Members of Silent Librarian are known to have been affiliated with the Iran-based Mabna Institute which has conducted cyber intrusions at the behest of the government of Iran, specifically the Islamic Revolutionary Guard Corps (IRGC).

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Reconnaissance
T1589.002 Email AddressesT1589.003 Employee NamesT1594 Search Victim-Owned WebsitesT1598.003 Spearphishing Link
Resource Development
T1583.001 DomainsT1585.002 Email AccountsT1588.002 ToolT1588.004 Digital CertificatesT1608.005 Link Target
Initial Access
T1078 Valid Accounts
Persistence
T1078 Valid Accounts
Privilege Escalation
T1078 Valid Accounts
Stealth
T1078 Valid Accounts
Credential Access
T1110.003 Password Spraying
Collection
T1114 Email CollectionT1114.003 Email Forwarding Rule

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.