Silent Librarian

{
  "id": "ATTACK:enterprise:G0122",
  "title": "Silent Librarian",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0122",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--90784c1e-4aba-40eb-9adf-7556235e6384",
  "external_id": "G0122",
  "domain": "enterprise",
  "created": "2021-02-03T16:36:38.145Z",
  "modified": "2026-07-31T18:48:08.693Z",
  "version": "1.0",
  "aliases": [
    "Silent Librarian",
    "TA407",
    "COBALT DICKENS"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "TA407"
    },
    {
      "source_name": "COBALT DICKENS"
    },
    {
      "source_name": "DOJ Iran Indictments March 2018",
      "url": "https://www.justice.gov/usao-sdny/press-release/file/1045781/download"
    },
    {
      "source_name": "Phish Labs Silent Librarian",
      "url": "https://info.phishlabs.com/blog/silent-librarian-more-to-the-story-of-the-iranian-mabna-institute-indictment"
    },
    {
      "source_name": "Malwarebytes Silent Librarian October 2020",
      "url": "https://blog.malwarebytes.com/malwarebytes-news/2020/10/silent-librarian-apt-phishing-attack/"
    },
    {
      "source_name": "Proofpoint TA407 September 2019",
      "url": "https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian"
    },
    {
      "source_name": "Secureworks COBALT DICKENS August 2018",
      "url": "https://www.secureworks.com/blog/back-to-school-cobalt-dickens-targets-universities"
    },
    {
      "source_name": "Secureworks COBALT DICKENS September 2019",
      "url": "https://www.secureworks.com/blog/cobalt-dickens-goes-back-to-school-again"
    }
  ]
}