Overview 836 indicators
Silent Librarian is a group that has targeted research and proprietary data at universities, government agencies, and private sector companies worldwide since at least 2013. Members of Silent Librarian are known to have been affiliated with the Iran-based Mabna Institute which has conducted cyber intrusions at the behest of the government of Iran, specifically the Islamic Revolutionary Guard Corps (IRGC).
| domain | 836 | G0122-domain.txt |
Techniques 13 ATT&CK
Open in ATT&CK Navigator → or download the layer (13 techniques, layer 4.5)
- T1078 Valid Accounts
- T1110.003 Password Spraying
- T1114 Email Collection
- T1114.003 Email Forwarding Rule
- T1583.001 Domains
- T1585.002 Email Accounts
- T1588.002 Tool
- T1588.004 Digital Certificates
- T1589.002 Email Addresses
- T1589.003 Employee Names
- T1594 Search Victim-Owned Websites
- T1598.003 Spearphishing Link
- T1608.005 Link Target
Principal sources 149 reports
Ranked by how many of this actor's indicators each report brought in.
- 194secureworks.com/blog/back-to-school-cobalt-dickens-targ…
- 194secureworks.com/blog/cobalt-dickens-goes-back-to-school…
- 194otx.alienvault.com/pulse/5d78eaf37b37c503fb07d45a
- 194proofpoint.com/us/threat-insight/post/threat-actor-pro…
- 194otx.alienvault.com/pulse/5da4a7ab756627fcce84efcc
- 99virustotal.com/gui/ip-address/172.67.171.15/relations
- 57twitter.com/TeamDreier/status/1751931807648366669
- 44virustotal.com/gui/ip-address/195.110.38.176/relations
Timeline 836 indicators
Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.
Showing the 300 most recent of 836. Complete: G0122.json.
No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.
-
twitter.com/TeamDreier/status/1751931807648366669
balamand.edu.lb.ezlibin.com bib.mdh.se.ezlibin.com bib.mdh.se.libinpro.xyz edu.jo.ezlibin.com edu.jo.libinpro.xyz edu.lb.ezlibin.com edu.lb.libinpro.xyz edu.sg.libinpro.xyz edu.tr.ezlibin.com ez.liblogin.com ezlibin.com ezpro.libinpro.xyz ezproxy.hkr.se.liblogin.com ezproxy.mef.edu.tr.ezlibin.com ezproxy.ug.edu.gh.liblogin.com ezproxy3.hkr.se.liblogin.com ezsecureaccess.balamand.edu.lb.ezlibin.com jo.ezlibin.com jo.libinpro.xyz lau.edu.lb.libinpro.xyz lb.ezlibin.com lb.libinpro.xyz li.ezlibin.com libinpro.xyz liblogin.com libra.libinpro.xyz librar.libinpro.xyz library.zuj.edu.jo.libinpro.xyz library1.zuj.edu.jo.ezlibin.com library1.zuj.edu.jo.libinpro.xyz library2.zuj.edu.jo.libinpro.xyz login.ezsecureaccess.balamand.edu.lb.ezlibin.com mail.library.zuj.edu.jo.libinpro.xyz mail.mdh.se.libinpro.xyz mail.proxy.mau.se.libinpro.xyz mail.proxy1.mau.se.libinpro.xyz mau.se.ezlibin.com mau.se.libinpro.xyz mdh.se.ezlibin.com mdh.se.libinpro.xyz mef.edu.tr.ezlibin.com ndu.edu.lb.ezlibin.com neptune.ndu.edu.lb.ezlibin.com neptune.ndu.edu.lb.liblogin.com proxy.libinpro.xyz proxy.mau.se.ezlibin.com proxy.mau.se.libinpro.xyz proxy.mau.se.liblogin.com proxy1.mau.se.libinpro.xyz proxy2.mau.se.liblogin.com se.ezlibin.com se.libinpro.xyz sg.libinpro.xyz sutd.edu.sg.libinpro.xyz tr.ezlibin.com zuj.edu.jo.ezlibin.com zuj.edu.jo.libinpro.xyz -
twitter.com/TeamDreier/status/1582087294106107904 · virustotal.com/gui/ip-address/88.135.39.148/relations
ezpro.fa.ru.lib4login.com lib4login.com library.gju.edu.jo.lib4login.com login1.ep.bib.mdh.se.lib4login.com -
twitter.com/TeamDreier/status/1564899016575524865 · virustotal.com/gui/ip-address/5.9.154.209/relations
ezproxy.fhstp.ac.at.libraryezlogin.com libraryezlogin.com -
twitter.com/TeamDreier/status/1550716056154537986
bradley.ledu.me bradley.rvedu.me bradley.zedu.me ledu.me login.bradley.ledu.me login.bradley.rvedu.me login.bradley.zedu.me logon.bradley.ledu.me logon.bradley.rvedu.me logon.bradley.zedu.me rvedu.me zedu.me -
twitter.com/TeamDreier/status/1550501403440848897
cardiff.ac.erlib.me cardiff.ac.plib.me ease.ed.ac.rnlib.me ease.ed.ac.slib.me ease.ed.rnlib.me ease.ed.slib.me erlib.me login.cardiff.ac.erlib.me login.cardiff.ac.plib.me plib.me rnlib.me slib.me -
twitter.com/TeamDreier/status/1542616491861983237 · twitter.com/TeamDreier/status/1548769825350107136 · virustotal.com/gui/ip-address/185.18.212.117/relations
identity.uoguelph.libun.me libun.me sso2.identity.uoguelph.libun.me uoguelph.libun.me -
twitter.com/TeamDreier/status/1542532506070794244 · twitter.com/TeamDreier/status/1548362809238466561 · virustotal.com/gui/ip-address/185.51.202.228/relations
identity.uoguelph.rnedu.me rnedu.me sso2.identity.uoguelph.rnedu.me uoguelph.rnedu.me -
virustotal.com/gui/ip-address/195.110.38.176/relations
login.microsoftonline.urca.me microsoftonline.urca.me urca.me -
twitter.com/TeamDreier/status/1542616491861983237 · twitter.com/TeamDreier/status/1548769825350107136 · virustotal.com/gui/ip-address/185.18.212.117/relations
bolton.ac.rvuk.me edlv.me idp.bolton.ac.rvuk.me login.microsoftonline.edlv.me login.microsoftonline.ulca.me microsoftonline.edlv.me microsoftonline.ulca.me rvuk.me ulca.me -
twitter.com/TeamDreier/status/1542532506070794244 · twitter.com/TeamDreier/status/1548362809238466561 · virustotal.com/gui/ip-address/185.51.202.228/relations
bolton.ac.uk.rulk.me eolv.me idp.bolton.ac.uk.rulk.me login.microsoftonline.eolv.me login.microsoftonline.rvcon.me microsoftonline.eolv.me microsoftonline.rvcon.me rulk.me rvcon.me -
virustotal.com/gui/ip-address/195.110.38.176/relations
bolton.ac.rnuk.me idp.bolton.ac.rnuk.me login.microsoftonline.redur.me microsoftonline.redur.me redur.me rnuk.me -
twitter.com/TeamDreier/status/1547211813703585793
ezproxy.uniroma1.ruit.me ezproxy.uniroma1.rvit.me ezproxy.uniroma1.urnit.me login.ezproxy.uniroma1.ruit.me login.ezproxy.uniroma1.rvit.me login.ezproxy.uniroma1.urnit.me ruit.me rvit.me uniroma1.ruit.me uniroma1.rvit.me uniroma1.urnit.me urnit.me -
virustotal.com/gui/ip-address/195.110.38.176/relations
login.svproxy.svcc.urnd.me svcc.urnd.me svproxy.svcc.urnd.me urnd.me -
twitter.com/TeamDreier/status/1544801657149689857
cas.lcc.edu.llrn.me cas.lcc.llrn.me edu.llrn.me lcc.llrn.me llrn.me login.svproxy.svcc.reun.me reun.me svcc.reun.me svproxy.svcc.reun.me -
virustotal.com/gui/ip-address/172.67.171.15/relations
12st.me 12xb.me 1r3o.me 28ag.me 32ex.me 33qa.me 67vr.me 67yt.me bcfk.me bdhw.me c23e.me cqgp.me cuvl.me cx71.me cxam.me cynf.me d2a7.me d39j.me dbck.me dboc.me dhfb.me do78.me dwfa.me edmh.me ejna.me fdqk.me fgds.me fqmu.me fvne.me gajr.me gboe.me geuy.me glpk.me gujv.me hzse.me ip8h.me iqtw.me iwdz.me jfg5.me jfmn.me jiuf.me kdpn.me kqxt.me kxli.me l5oj.me lgyw.me lmpt.me lu7b.me mgyr.me mxig.me ndmb.me nz89.me omhw.me omth.me onhj.me pveq.me q5sl.me qlma.me rp6h.me rvgh.me rwpb.me rwzx.me rxsn.me t12u.me tlvd.me tumx.me twrb.me ua5v.me uieg.me umpb.me uwrd.me uxcz.me vbel.me vjwk.me wa13.me wdkz.me wghi.me wl6g.me wo2k.me wxpi.me wygo.me x27i.me xdor.me xdry.me xe91.me xfaj.me xgqf.me xrig.me xuoe.me xzat.me y1rk.me yc22.me yqik.me za78.me zeyg.me zjhb.me zkvb.me zvwb.me -
twitter.com/TeamDreier/status/1543515353866723332
bradley.eulib.me eulib.me logon.bradley.eulib.me -
twitter.com/TeamDreier/status/1543463124417781761
bradley.ulibe.me logon.bradley.ulibe.me ulibe.me -
twitter.com/TeamDreier/status/1543460845467930625
bradley.lible.me lible.me logon.bradley.lible.me -
virustotal.com/gui/ip-address/104.21.19.105/relations · virustotal.com/gui/ip-address/172.67.171.15/relations
ncbv.me -
twitter.com/TeamDreier/status/1542953972973068294
comn.me cornn.me login.microsoftonline.comn.me login.microsoftonline.cornn.me microsoftonline.comn.me microsoftonline.cornn.me -
twitter.com/TeamDreier/status/1542532506070794244 · twitter.com/TeamDreier/status/1548362809238466561 · virustotal.com/gui/ip-address/185.51.202.228/relations
ciff.login.nerb.me edll.me ezproxy.uniroma1.rnit.me ezproxy.uniroma1.uvit.me login.ezproxy.uniroma1.rnit.me login.ezproxy.uniroma1.uvit.me login.nerb.me nerb.me rnit.me uniroma1.rnit.me uniroma1.uvit.me uvit.me -
twitter.com/TeamDreier/status/1542241300111564800 · virustotal.com/gui/ip-address/185.18.212.117/relations
edou.me library2.ramapo.pndu.me library2.ramapo.rcedu.me pndu.me ramapo.pndu.me ramapo.rcedu.me rcedu.me -
twitter.com/TeamDreier/status/1542616491861983237 · twitter.com/TeamDreier/status/1548769825350107136 · virustotal.com/gui/ip-address/185.18.212.117/relations
adfs.goucher.pdlu.me adfs.goucher.unde.me goucher.pdlu.me goucher.unde.me pdlu.me unde.me -
twitter.com/TeamDreier/status/1534391270197628928 · virustotal.com/gui/ip-address/195.110.38.176/relations
cedu.me fsw.cedu.me fsw.uedu.me sso.fsw.cedu.me sso.fsw.uedu.me uedu.me -
twitter.com/TeamDreier/status/1542155689631617025 · virustotal.com/gui/ip-address/185.18.212.117/relations
acuk.me cardiff.acuk.me login.cardiff.acuk.me -
twitter.com/TeamDreier/status/1541750405943775232
hemid.me -
twitter.com/TeamDreier/status/1540791986827010052
liucat.lib.liu.nedu.me liucat.lib.liu.ollu.me nedu.me ollu.me
Further reading 152
- attack.mitre.org/groups/G0122
- blog.malwarebytes.com/malwarebytes-news/2020/10/silent-librar…
- info.phishlabs.com/blog/silent-librarian-more-to-the-story…
- justice.gov/usao-sdny/press-release/file/1045781/do…
- proofpoint.com/us/threat-insight/post/threat-actor-pro…
- secureworks.com/blog/back-to-school-cobalt-dickens-targ…
- secureworks.com/blog/cobalt-dickens-goes-back-to-school…
- twitter.com/TeamDreier/status/1336251373097267202
- twitter.com/TeamDreier/status/1517783469828542464
- twitter.com/TeamDreier/status/1351797305926676480
- twitter.com/TeamDreier/status/1522239764723863553
- twitter.com/peterkruse/status/1312819332318146561
- twitter.com/TeamDreier/status/1533526839997734914
- twitter.com/TeamDreier/status/1486250419730984963
- twitter.com/TeamDreier/status/1321725647153233920
- twitter.com/TeamDreier/status/1539698078038589440
- twitter.com/TeamDreier/status/1335877271593377792
- twitter.com/TeamDreier/status/1543515353866723332
- twitter.com/TeamDreier/status/1466475837235027970
- twitter.com/TeamDreier/status/1518842981175996416
- twitter.com/TeamDreier/status/1523553694867804161
- twitter.com/TeamDreier/status/1318073712621608960
- twitter.com/TeamDreier/status/1322301000963805184
- twitter.com/andsyn1/status/1331321796226846721
- twitter.com/TeamDreier/status/1384079500737011714
- twitter.com/TeamDreier/status/1433325012623269890
- twitter.com/TeamDreier/status/1493135702091079760
- twitter.com/TeamDreier/status/1523721652059602944
- twitter.com/TeamDreier/status/1321197043784843267
- twitter.com/TeamDreier/status/1478117520708149254
- twitter.com/TeamDreier/status/1544801657149689857
- otx.alienvault.com/pulse/5d78eaf37b37c503fb07d45a
- twitter.com/TeamDreier/status/1338979116855554056
- twitter.com/TeamDreier/status/1534391270197628928
- twitter.com/TeamDreier/status/1541750405943775232
- twitter.com/TeamDreier/status/1531013356781555712
- twitter.com/TeamDreier/status/1410141072920125447
- twitter.com/TeamDreier/status/1526316357683499008
- twitter.com/TeamDreier/status/1401790878092611587
- twitter.com/TeamDreier/status/1475412283421601795
112 more, and the report behind every indicator, in G0122.json.