TA407

TA407 is Proofpoint's threat actor designation for the Iranian academic espionage group known as Silent Librarian and COBALT DICKENS, operated through the Mabna Institute front company. The designation is used by Proofpoint specifically for email-based campaign tracking of the group's credential phishing operations targeting universities and research institutions. TA407 activity aligns precisely with the broader Silent Librarian and COBALT DICKENS tracking of the same IRGC-directed academic data theft campaign documented across multiple vendors from 2013 through 2020.