Actors Insights|Latest update04/07/2026

Mabna Institute Cluster

Suspected state sponsor: Islamic Republic of Iran

Mabna Institute is an Iranian front company indicted by the US Department of Justice in March 2018 for conducting a massive cyber theft campaign targeting universities, research institutions, and government agencies worldwide on behalf of the Islamic Revolutionary Guard Corps (IRGC). The company — and the hacking campaign it operated — represents one of the largest documented state-sponsored academic data theft operations in history.

 

Targets and Goals

The Mabna Institute campaign targeted over 300 universities across 22 countries, as well as companies, government agencies, and NGOs. The group focused on stealing academic research, scientific papers, and intellectual property — material that would otherwise cost Iran enormous resources to develop domestically. The US DOJ indictment identified 144 terabytes of stolen academic data with an estimated value of approximately $3.4 billion. Targets were selected based on the scientific value of their research, with a particular focus on fields relevant to Iranian scientific and military development.

 

Tooling and Tactics

The group's primary method was spear phishing emails sent to professors and researchers, impersonating library systems and academic resource providers. Victims were directed to fake login pages that harvested university credentials, which were then used to access library databases, research portals, and email accounts. The operation was methodical and large-scale, with the group maintaining updated lists of target faculty across hundreds of institutions. Nine Iranian nationals were indicted in the US for their roles in the operation.

 

Aliases

The hacking operation is tracked as Silent Librarian by SecureWorks and Proofpoint, COBALT DICKENS by SecureWorks, and TA407 by Proofpoint. All names describe the same IRGC-directed academic espionage campaign operated through the Mabna Institute front company.

Most Common Tactics

Targeted Regions

Australia
AU
Australia
Australia
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Mar 2018 ~ Oct 2020
Mar 2018 ~ Oct 2020
May 2018 ~ Aug 2018
Mar 2018 ~ Oct 2020
Mar 2018 ~ Oct 2020
Jul 2019 ~ Sep 2019
Mar 2018 ~ Oct 2020
Mar 2018 ~ Oct 2020
Canada
CA
Canada
Canada
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
May 2018 ~ Aug 2018
Jul 2019 ~ Sep 2019
China
CN
China
China
May 2018 ~ Aug 2018
Europe
EU
Europe
Europe
Oct 2013 ~ Oct 2019
Oct 2013 ~ Oct 2019
Oct 2013 ~ Oct 2019
Oct 2013 ~ Oct 2019
Oct 2013 ~ Oct 2019
Oct 2013 ~ Oct 2019
Oct 2013 ~ Oct 2019
Oct 2013 ~ Oct 2019
Oct 2013 ~ Oct 2019
Oct 2013 ~ Oct 2019
Oct 2013 ~ Oct 2019
France
FR
France
France
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Germany
DE
Germany
Germany
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
May 2018 ~ Aug 2018
Hong Kong
HK
Hong Kong
Hong Kong
Jul 2019 ~ Sep 2019
Israel
IL
Israel
Israel
May 2018 ~ Aug 2018
Italy
IT
Italy
Italy
May 2018 ~ Aug 2018
Japan
JP
Japan
Japan
May 2018 ~ Aug 2018
Netherlands
NL
Netherlands
Netherlands
May 2018 ~ Aug 2018
Oman
OM
Oman
Oman
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
South Africa
ZA
South Africa
South Africa
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
May 2018 ~ Aug 2018
Sweden
SE
Sweden
Sweden
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Switzerland
CH
Switzerland
Switzerland
May 2018 ~ Aug 2018
Jul 2019 ~ Sep 2019
Turkey
TR
Turkey
Turkey
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
May 2018 ~ Aug 2018
United Kingdom
GB
United Kingdom
United Kingdom
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
Sep 2013 ~ Mar 2018
May 2018 ~ Aug 2018
Jul 2019 ~ Sep 2019
United States
US
United States
United States
Sep 2013 ~ Mar 2018
Oct 2013 ~ Oct 2019
Sep 2013 ~ Mar 2018
Oct 2013 ~ Oct 2019
Sep 2013 ~ Mar 2018
Oct 2013 ~ Oct 2019
Sep 2013 ~ Mar 2018
Oct 2013 ~ Oct 2019
Sep 2013 ~ Mar 2018
Oct 2013 ~ Oct 2019
Sep 2013 ~ Mar 2018
Oct 2013 ~ Oct 2019
Sep 2013 ~ Mar 2018
Oct 2013 ~ Oct 2019
Sep 2013 ~ Mar 2018
Oct 2013 ~ Oct 2019
Mar 2018 ~ Oct 2020
Oct 2013 ~ Oct 2019
Mar 2018 ~ Oct 2020
May 2018 ~ Aug 2018
Oct 2013 ~ Oct 2019
Mar 2018 ~ Oct 2020
Oct 2013 ~ Oct 2019
Mar 2018 ~ Oct 2020
Jul 2019 ~ Sep 2019
Mar 2018 ~ Oct 2020
Mar 2018 ~ Oct 2020
Jan 2013Jun 2026

Recent Activities

  1. Public
    Silent Librarian Resumes Spearphishing Attacks Against Global Universities
  2. Public
    TA407’s Phishing Campaigns Continue Targeting Universities Globally
  3. Public
    COBALT DICKENS Targets Global Universities in Persistent Phishing Campaign
see more

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.