Silent Librarian has used compromised credentials to obtain unauthorized access to online accounts.4
group
Silent Librarian G0122
- Created
- 3 February 2021
- Last modified
- 31 July 2026
- Aliases
- Silent Librarian · TA407 · COBALT DICKENS
Silent Librarian is a group that has targeted research and proprietary data at universities, government agencies, and private sector companies worldwide since at least 2013. Members of Silent Librarian are known to have been affiliated with the Iran-based Mabna Institute which has conducted cyber intrusions at the behest of the government of Iran, specifically the Islamic Revolutionary Guard Corps (IRGC).[1][2][3]
13
Techniques40th pct
8
Tactics48th pct
0
Tools & malwareNone recorded
0
CampaignsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference G0122
Silent Librarian has used collected lists of names and e-mail accounts to use in password spraying attacks against private sector targets.5
Silent Librarian has exfiltrated entire mailboxes from compromised accounts.6
Silent Librarian has set up auto forwarding rules on compromised e-mail accounts.7
Silent Librarian has acquired domains to establish credential harvesting pages, often spoofing the target organization and using free top level domains .TK, .ML, .GA, .CF, and .GQ.8910111213
Silent Librarian has established e-mail accounts to receive e-mails forwarded from compromised accounts.14
Standing G0122
Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques1340th pct
40th percentile · 60% of 176 ATT&CK groups have more Enterprise techniques.
Tactics848th pct
48th percentile · 52% of 176 ATT&CK groups have more tactics spanned.
Tools & malware0Bottom 9%
9th percentile · 91% of 176 ATT&CK groups have more tools and malware.
Campaigns089% tie · 4 values
89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique1medBottom 6%
6th percentile · 94% of 176 ATT&CK groups have more detection rules per technique.
Tests / technique0med
Detection coverage G0122
179 distinct rules cover the 13 techniques recorded for this group. The 184 technique-to-rule mappings resolve to 179 distinct rules, because one rule can cover several techniques. 92 Splunk · 87 Sigma.
7 covered by at least one rule6 with no coverage179 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org