Forensia CTI Core

Profile

Silent Librarian is a group that has targeted research and proprietary data at universities, government agencies, and private sector companies worldwide since at least 2013. Members of Silent Librarian are known to have been affiliated with the Iran-based Mabna Institute which has conducted cyber intrusions at the behest of the government of Iran, specifically the Islamic Revolutionary Guard Corps (IRGC).

MITRE ATT&CK ↗

Techniques

13 ATT&CK techniques attributed to this actor.

T1078 Valid Accounts T1110.003 Password Spraying T1114 Email Collection T1114.003 Email Forwarding Rule T1583.001 Domains T1585.002 Email Accounts T1588.002 Tool T1588.004 Digital Certificates T1589.002 Email Addresses T1589.003 Employee Names T1594 Search Victim-Owned Websites T1598.003 Spearphishing Link T1608.005 Link Target

Related corpus activity

2,052 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Silent Librarian.

Indicator	Type	Family	Sev	Src
cve-2026-4368	cve	ransomware	85	1
cve-2024-1781	cve	—	85	1
cve-2025-23304	cve	—	85	2
cve-2017-17215	cve	—	85	2
cve-2026-22584	cve	—	85	2
cve-2025-68670	cve	—	85	2
cve-2018-8007	cve	—	85	1
cve-2016-0638	cve	phishing	85	1
cve-2025-66478	cve	—	85	2
cve-2025-0921	cve	—	85	2
9eaa577c8ba71646928c1c34c3145536b0498f65f26060a6ba00744bcef57644	sha256	phishing	80	1
479ae5fd7274439ddfa27bc03298ebfdfc5ff17f6412acccf74d4dbd90d94218	sha256	phishing	80	1
6c700ca4e6d917c7aa9d964e98604a0349d9b8b4673df96a3f73a3d2d042635a	hash	—	80	2
f1551d3e5d144eef4e70a29dd3dc52fb22459d1f	hash	—	80	2
874bcb1c3d050a5b5b333a2198f504fcb27927c2abdd43b07440188a380c52d5	sha256	phishing	80	1
78a82d93b4f580835f5823b85a3d9ee1f03a15ee6f0e01b4eac86252a7002981	hash	supply_chain	80	1
308351124c496d4f4effee65ab828506abf70385773c167ab1f32a7f030385ac	hash	—	80	2
2654c08491a0f7c4a3dfc6282de5638b	hash	—	80	3
625b6535321d58bb5c613e85332bf731	hash	—	80	3
681075027553546c119ec447eb8df84633dcffce	hash	—	80	3
873f1277a42de5c82f869459e7fb7c94554a642b	hash	—	80	3
52fda5c1b9704544f32ee98d9060e689	hash	ransomware	80	2
3b6cb20891bce8602ce669187754871e402a1782031ef8b032cd007e3894bc5d	hash	—	80	2
6a69ea2ce3fea0ebfd7a32a1dfc4251bd4d7d8a4fbd44aaa47b82290d0414a9f	hash	—	80	2
d78f64551d1b31a31e5998e442f0debd458e011e05019b3951d9ddde997f8384	hash	—	80	2
4253dd1a4c0867b0be7732f75b2f630cebfb7fed94270e15fb3b12ae40546d01	sha256	phishing	80	1
2758f4d71a2a2dfdefab81737c2d776b2a3dafe5844fdd2157e089a28447ca98	sha256	phishing	80	1
123e80a34508c4dede7cc70e76931fcc	hash	—	80	3
b8eed63ab9cbdca494f26a6f66bfd4a0a693b3f0	hash	—	80	3
01e3dce00ea45829bd9f6a583004976ac63973a0	hash	cryptojacking	80	1

Showing the top 30 by severity of 2,052.