Actors Insights|Latest update04/07/2026

COBALT DICKENS

Named by SecureWorksSuspected state sponsor: Islamic Republic of Iran

COBALT DICKENS is Secureworks' designation for the Iranian academic espionage cluster known as Silent Librarian and operated through the Mabna Institute front company. Active since at least 2013, the group targeted universities and research institutions across more than 22 countries using spear phishing emails impersonating library and academic resource portals to harvest faculty and student credentials. Secureworks documented continued COBALT DICKENS campaigns in 2018 and 2019, showing the group persisted with the same credential harvesting methodology even after the US DOJ indictment of nine Iranian nationals connected to the operation.

First Seen:Oct 2013
Last Seen:Oct 2020
Indexed Reports:2
Public IOCs:160
Cluster: Mabna InstituteMitre: Silent LibrarianMisp: Silent Librarian
also known as:
COBALT DICKENS (SecureWorks)Mabna Institute (real name)TA407 (Proofpoint)TA4900 (Proofpoint)Yellow Nabu (PWC)Silent Librarian (PhishLabs)G0122 (Mitre)

Targeted Regions

Australia
AU
Australia
Australia
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
Jul 2019 ~ Sep 2019
Jul 2019 ~ Sep 2019
Canada
CA
Canada
Canada
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
Jul 2019 ~ Sep 2019
Jul 2019 ~ Sep 2019
China
CN
China
China
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
Germany
DE
Germany
Germany
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
Hong Kong
HK
Hong Kong
Hong Kong
Jul 2019 ~ Sep 2019
Jul 2019 ~ Sep 2019
Israel
IL
Israel
Israel
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
Italy
IT
Italy
Italy
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
Japan
JP
Japan
Japan
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
Netherlands
NL
Netherlands
Netherlands
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
South Africa
ZA
South Africa
South Africa
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
Switzerland
CH
Switzerland
Switzerland
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
Jul 2019 ~ Sep 2019
Jul 2019 ~ Sep 2019
Turkey
TR
Turkey
Turkey
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
United Kingdom
GB
United Kingdom
United Kingdom
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
Jul 2019 ~ Sep 2019
Jul 2019 ~ Sep 2019
United States
US
United States
United States
May 2018 ~ Aug 2018
May 2018 ~ Aug 2018
Jul 2019 ~ Sep 2019
Jul 2019 ~ Sep 2019
Jan 2018Aug 2026

Recent Indexed Reports

  1. Public
    COBALT DICKENS Targets Global Universities in Persistent Phishing Campaign
  2. Public
    COBALT DICKENS Phishing Campaign Targets Global Universities for Credential Theft

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.