Silent Librarian - G0122

Created: 2021-02-03T16:36:38.145Z

Modified: 2021-04-21T12:02:00.278Z

Contributors:

Aliases

Silent Librarian,TA407,COBALT DICKENS

Description

Silent Librarian is a group that has targeted research and proprietary data at universities, government agencies, and private sector companies worldwide since at least 2013. Members of  Silent Librarian are known to have been affiliated with the Iran-based Mabna Institute which has conducted cyber intrusions at the behest of the government of Iran, specifically the Islamic Revolutionary Guard Corps (IRGC).(Citation: DOJ Iran Indictments March 2018)(Citation: Phish Labs Silent Librarian)(Citation: Malwarebytes Silent Librarian October 2020)

Techniques Used

Silent Librarian has cloned victim organization login pages and staged them for later use in credential harvesting campaigns.

Silent Librarian has also made use of a variety of URL shorteners for these staged websites.(Citation: Secureworks COBALT DICKENS September 2019)(Citation: Malwarebytes Silent Librarian October 2020)(Citation: Proofpoint TA407 September 2019)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

Silent Librarian has obtained free and publicly available tools including SingleFile and HTTrack to copy login pages of targeted organizations.(Citation: Proofpoint TA407 September 2019)(Citation: Secureworks COBALT DICKENS September 2019)|
|mitre-attack|enterprise-attack|PRE|T1588.004|Digital Certificates|

Silent Librarian has obtained free Let's Encrypt SSL certificates for use on their phishing pages.(Citation: Phish Labs Silent Librarian)(Citation: Secureworks COBALT DICKENS September 2019)|
|mitre-attack|enterprise-attack|PRE|T1585.002|Email Accounts|