Silent LibrarianThreat actor
- cobalt dickens
- Mabna Institute
- mabna institute group
- ta407
- ta4900
- yellow nabu
Last Friday, Deputy Attorney General Rod Rosenstein announced the indictment of nine Iranians who worked for an organization named the Mabna Institute. According to prosecutors, the defendants stole more than 31 terabytes of data from universities, companies, and government agencies around the world. The cost to the universities alone reportedly amounted to approximately $3.4 billion.From MISP Galaxy
Last reported 19 days ago, by Security Affairs7 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1505.003Web Shell
“They deploy a Java web shell and then steal user credentials and past emails.”
- T1684Social Engineering
““With our international partners, we strongly encourage individuals at risk to familiarize themselves with the social-engineering techniques described in the advisory, and to act on the mitigation advice.””
- T1014Rootkit
“…able Roundcube servers to relay C2 traffic and also exploited CVE-2026-68820, a zero-day vulnerability in Windows to deploy a FudModule rootkit.”
- T1195Supply Chain Compromise
“In regards to cybercrime, we noted a Rust crates supply-chain compromise via typosquatted dependency, with infrastructure overlapping with operations attributed to North Korea-linked threat actors.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
7 reports, newest first · the exact sentence from each-
Iranian hacker accused of draining 31TB from university inboxes extradited to the US“Prosecutors allege they were part of an operation run through the Iranian Mabna Institute on behalf of the Islamic Revolutionary Guard Corps.”
-
In Rare Move, Alleged Iranian State Hacker Extradited to US“In August, the US unsealed a 14-count superseding indictment charging 17 members of the Iran-based company Mabna Institute for hacking activities targeting hundreds of entities in the US and abroad.”
-
Risky Bulletin: Authorities dismantle KillSec group, arrest members across Europe“US officials claim he's a member of Silent Librarian, an Iranian APT specialized in hacking and stealing private research from universities.”
-
Cyber Brief 26-09 - August 2026“On August 18, the US Department of Justice charged 17 Iranians of Mabna Institute, an Iranian company, for conducting a cyberespionage campaign targeting 144 US-based universities, 178 foreign universities, at least 42 US-based companies, at least 11 foreign companies, at least f…”
-
NCSC and Allies Warn of Iranian Spyware Campaign“Read more on Iranian threats: US Sanctions Mabna Institute Hackers for Iranian Cyber-Attacks.”
-
Risky Bulletin: Russia starts blocking DoH and DoT“Sanctions were imposed on individuals working for the Tehran-based Mabna Institute, a cyber contractor for the Iranian government.”
-
US Sanctions Mabna Institute Hackers for Iranian Cyber-Attacks“US Sanctions Mabna Institute Hackers for Iranian Cyber-Attacks”
Indicators in its reports
named in the reports above- bc[.]monsterin 1 report
- xn--eck9c3e[.]zonein 1 report
- mk[.]ggin 1 report
- scarnecchia[.]netin 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.