← threat actors
threat actor · IR
Silent Librarian
also tracked as mabna institute 2
2 stories · 1 in the wild · August 20, 2026 – October 3, 2026
evidence: 1 observed
how they got in
- phishing email 1 · Aug 20
sectors
- education 2 · Oct 3
- government 2 · Oct 3
geography
- iran 2 · Oct 3
- united states 1 · Oct 3
attack phases seen
- Initial access 1 · Aug 20
- Reconnaissance 1 · Aug 20
what we reported, newest first, grouped by story
October 3, 2026
- Iranian national Amir Barati was extradited from Montenegro to the US on October 1, in a rare extradition of an alleged state-linked operator. Barati, a 40-year-old Iranian-Turkish dual national and alleged Mabna Institute member, was named among 17 Iranian nationals in an August 2026 SDNY superseding indictment over a campaign against universities, private organizations and government entities (The Record, SecurityWeek).
· Oct 3 · none · as mabna institute · Breaches, Takedowns & Attribution
August 20, 2026
- The US charged 17 members of Iran's Mabna Institute over a decade-long spearphishing campaign against university professors and government email accounts, with $3.4B in claimed IP theft and $10M rewards on five defendants. The 50-page superseding indictment carries considerably more methodological detail on the three-phase targeting than the press coverage (The Record, SecurityWeek, indictment analysis) (discussion).
· Aug 20 · observed · via phishing email · as mabna institute · Threat Intelligence