Threat Actor Profile Silent Librarian

Attribution

It can be stated with a high degree of confidence that Silent Librarian operates on behalf of the Iranian government. This assessment is based on research of various sources providing evidence regarding the sponsorship of Silent Librarian’s operations. According to the news site and think tank Council on Foreign Relations, Silent Librarian operates on behalf of the Mabna Institute, which is an Iran-based private company acting in service of the Islamic Revolutionary Guard Corps (IRGC) to steal credentials and intellectual property for private financial gain and to be used by the IRGC.

Strategic motivations

Silent Librarian’s main strategic motivations are information theft and economic espionage. The group mainly targets educational institutions to acquire intellectual property. It appears that Silent Librarian does not focus on specific academic disciplines, but rather operates on an opportunistic basis and steals the information that they manage to access.  

Hunt & Hackett’s research indicates that the focus on the academic sector is linked to sanctions related to technology and other goods in Iran. Western sanctions on Iran affect their scientific community. For example, cutting them from the international financial system makes it harder for individuals to subscribe to international academic journals. Importing western technologies is also restricted. These restrictions set a motivation for Iran to get their hands on this knowledge or technologies in other ways.  

Silent Librarian was previously observed selling their stolen data on an Iranian website named Megapaper[.]ir, as well as selling access to compromised accounts via another Iranian website called Gigapaper[.]ir. This indicates that they might also pursue financial gain.   

Target selection

During their campaigns Silent Librarian most often focuses on information theft or credential theft from individuals working for organizations that possess data that is potentially valuable for the group. Among the victimized institutions were many universities, being by far the most prevalent victimized organization type and therefore making the educational sector Silent Librarian’s primary target. However, in their earlier campaigns some private and government sectors were also targeted[8]. Apart from an interview in 2017 with Crane Hassold (Director of Threat Intelligence at Phishlabs at that time) in the Washington Post, in which a focus on three specific sectors is mentioned, there are no indications that Silent Librarian focuses on specific knowledge areas. This is different from some actor groups from other nations that often demonstrate a clear interest in specific knowledge areas that align with the countries’ strategic agenda.

As to the private organizations targeted in the earliest campaigns of Silent Librarian, there is no publicly available information confirming their identities. However, Iran’s targets for commercial espionage typically fall into categories that relate to their commodities industry and military technological capabilities, which indicates a possibility that these sectors were targeted by Silent Librarian as well.

Although no specific geographical pattern or profile with regards to the victimized institutions can be found, it is notable that a large proportion of the attacks occurred in Western countries. Among the reported incidents with Silent Librarian, the prevalence of victimized organizations (mainly universities) within the US is highly over-represented, compared to other countries. Next up are European countries, which are highly represented in the list of victims as well. This indicates a particular interest of the threat actor in American and European knowledge institutions. A likely explanation for this is that Western sanctions on Iran restrict access to resources, including research and technology, which consequently leads to Iranian forces attempting to, and often succeeding at stealing otherwise restricted information. For organizations to determine their targetability by Silent Librarian, they should consider the attractiveness of their research assets.