Threat intelligence
- Suspected origin
- Iran
- First seen
- 2013-01-01 00:00:00
- Motivation
- Information theft and espionage
- Targeted sectors
- Education
- TLP
- WHITE
According to the Treasury Department, since 2013, the Mabna Institute hit 144 US universities and 176 universities in 21 foreign countries.
Geoffrey Berman, US Attorney for the Southern District of New York revealed that the spear phishing campaign targeted more than 100,000 university professors worldwide and about 8,000 accounts were compromised.
The Iranian hackers exfiltrated 31 terabytes, roughly 15 billion pages of academic projects were stolen.
The hackers also targeted the US Department of Labor, the US Federal Energy Regulatory Commission, and many private and non-governmental organizations.
The sanctions also hit the Mabna Institute, an Iran-based company that had a critical role in coordinating the attacks on behalf of Iran’s Revolutionary Guards.
Also see Shadow Academy.
Also known as
Academic SerpensCobalt DickensG0122Mabna InstituteSilent LibrarianTA407TA4900Yellow Nabu
MITRE ATT&CK techniques
T1114 Email CollectionT1594 Search Victim-Owned WebsitesT1078 Valid Accounts
Coverage 2
threat-intel
The U.S. Treasury has imposed fresh sanctions on nearly 60 Iran-linked entities, including individuals and vessels, as part of "Operation Economic Outcast." These sanctions target a cyber group affiliated with Iran's Min…

threat-intel
This week’s ThreatsDay bulletin highlights a diverse range of security threats, including a Remote Code Execution vulnerability in Gogs, a sophisticated Mabna Institute cyber espionage campaign targeting universities and…
