Actors Insights|Latest update09/05/2025

COBALT DICKENS

Named by SecureWorksSuspected state sponsor: Islamic Republic of Iran

An Iranian threat group, believed to be associated with the Iranian government. They are responsible for the phishing campaigns targeting university credentials and intellectual property. They have been active since at least 2013. Known for using spoofed login pages and domains.

First Seen:Oct 2013
Last Seen:Oct 2020
Indexed Reports:2
Public IOCs:160
Cluster: Mabna InstituteMitre: Silent LibrarianMisp: Silent Librarian
also known as:
COBALT DICKENS (SecureWorks)Mabna Institute (real name)TA407 (Proofpoint)TA4900 (Proofpoint)Yellow Nabu (PWC)Silent Librarian (PhishLabs)G0122 (Mitre)

Targeted Regions

Australia
AU
Australia
Australia
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
Jul 2019 ~ Sep 2019
Jul 2019 ~ Sep 2019
Canada
CA
Canada
Canada
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
Jul 2019 ~ Sep 2019
Jul 2019 ~ Sep 2019
China
CN
China
China
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
Germany
DE
Germany
Germany
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
Hong Kong
HK
Hong Kong
Hong Kong
Jul 2019 ~ Sep 2019
Jul 2019 ~ Sep 2019
Israel
IL
Israel
Israel
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
Italy
IT
Italy
Italy
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
Japan
JP
Japan
Japan
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
Netherlands
NL
Netherlands
Netherlands
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
South Africa
ZA
South Africa
South Africa
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
Switzerland
CH
Switzerland
Switzerland
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
Jul 2019 ~ Sep 2019
Jul 2019 ~ Sep 2019
Turkey
TR
Turkey
Turkey
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
United Kingdom
GB
United Kingdom
United Kingdom
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
Jul 2019 ~ Sep 2019
Jul 2019 ~ Sep 2019
United States
US
United States
United States
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
Jul 2019 ~ Sep 2019
Jul 2019 ~ Sep 2019
Jan 2018Sep 2025

Recent Indexed Reports

  1. Public
    COBALT DICKENS Targets Global Universities in Persistent Phishing Campaign
  2. Public
    COBALT DICKENS Phishing Campaign Targets Global Universities for Credential Theft

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.