Actors Insights|Latest update04/07/2026

Silent Librarian

Named by PhishLabsSuspected state sponsor: Islamic Republic of Iran

Silent Librarian is Proofpoint's designation for the Iranian academic espionage campaign operated through the Mabna Institute front company on behalf of the IRGC. Active since at least 2013, the group targeted university faculty, researchers, and students across more than 300 universities in 22 countries by sending phishing emails impersonating library systems and academic journal portals. Victims were directed to convincing fake login pages that harvested institutional credentials used to access library databases and research repositories. Proofpoint documented continued Silent Librarian campaigns in 2018-2020, demonstrating the group's persistence after the US DOJ indictment and OFAC sanctions against Mabna Institute operators.

First Seen:Sep 2013
Last Seen:Oct 2020
Indexed Reports:2
Public IOCs:142
Cluster: Mabna InstituteMitre: Silent LibrarianMisp: Silent Librarian
also known as:
COBALT DICKENS (SecureWorks)Mabna Institute (real name)TA407 (Proofpoint)TA4900 (Proofpoint)Yellow Nabu (PWC)Silent Librarian (PhishLabs)G0122 (Mitre)

Targeted Regions

Australia
AU
Australia
Australia
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Mar 2018 ~ Oct 2020
Mar 2018 ~ Oct 2020
Mar 2018 ~ Oct 2020
Mar 2018 ~ Oct 2020
Mar 2018 ~ Oct 2020
Mar 2018 ~ Oct 2020
Canada
CA
Canada
Canada
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
France
FR
France
France
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Germany
DE
Germany
Germany
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Oman
OM
Oman
Oman
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
South Africa
ZA
South Africa
South Africa
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sweden
SE
Sweden
Sweden
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Turkey
TR
Turkey
Turkey
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
United Kingdom
GB
United Kingdom
United Kingdom
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
United States
US
United States
United States
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Mar 2018 ~ Oct 2020
Mar 2018 ~ Oct 2020
Mar 2018 ~ Oct 2020
Mar 2018 ~ Oct 2020
Mar 2018 ~ Oct 2020
Mar 2018 ~ Oct 2020
Jan 2013Jun 2026

Targeted Sectors

UniversityGovernment Agencies and Services

Recent Indexed Reports

  1. Public
    Silent Librarian Resumes Spearphishing Attacks Against Global Universities
  2. Public
    Silent Librarian: Iranian Group Targets Global Universities and Research Institutions

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.