IranAttributedIRGC, via Mabna InstituteMixedActive 2013 – 2020Silent Librarian
Also known asTA407 · COBALT DICKENS · Academic Serpens · Yellow Nabu · Mabna Institute
Summary
Iran-based credential-theft operation run by members of the Mabna Institute, which the US Department of Justice says conducted many of its intrusions on behalf of the Islamic Revolutionary Guard Corps (IRGC) and sold stolen data to Iranian government and university customers. From about 2013 through at least December 2017 it phished more than 100,000 university professors, compromising about 8,000 accounts at 144 US and 178 foreign universities, and also breached US federal and state agencies, private companies, the UN and UNICEF, stealing about 31.5 TB of data (DOJ, Aug 2026 superseding indictment of 17 defendants; nine were first charged in 2018). Its tradecraft is high-volume spoofing of university library and login portals timed to each academic year, followed by mailbox access and email forwarding rules. Proofpoint (TA407) and Secureworks (COBALT DICKENS) tracked fresh 'back-to-school' waves in 2018 and 2019, and Malwarebytes saw another from September 2020. Proofpoint calls it "a prolific financially motivated actor operating out of Iran", while DOJ charges that its intrusions served the IRGC and other Iranian government entities.
Attribution
Named by a government: indictment, sanctions designation, joint advisory or official statement.
- US Department of Justice (SDNY) (Government, 2026-08-18)
Charges Mabna Institute members with a cyber-theft campaign on behalf of the IRGC - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Mabna Institute intrusions at the behest of the IRGC
Campaigns 3
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| 2020–21 academic-year phishing wave against universities | 2020-09 – 2020-10 | UK, USA, Canada, Australia, Netherlands, Sweden, Singapore, Germany | Academia | Malwarebytes (2020-10-14) |
| TA407 university phishing waves (library-portal spoofs) | 2019-01 – 2019-09 | North America, Europe | Academia | Proofpoint (2019-10-14) |
| Mabna Institute university and government credential-theft campaign (DOJ) | 2013 – 2017-12 | USA, Global | Academia, Government, Private Sector, NGO | US DOJ (2018-03-23; superseding indictment 2026-08-18) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 6
| Reconnaissance3 | T1598.003Spearphishing LinkT1594Search Victim-Owned WebsitesT1589.003Employee Names |
|---|---|
| Stealth1 | T1078Valid Accounts |
| Credential Access1 | T1110.003Password Spraying |
| Collection1 | T1114.003Email Forwarding Rule |
Infrastructure patterns
- Freenom domains (.tk, .cf) for phishing; compromised university accounts phish others (Proofpoint, 2019)
- Cloudflare-fronted phishing hosts hide servers in Iran; Let's Encrypt certificates (Malwarebytes, 2020; MITRE ATT&CK, 2026)