January 1, 2022
16:00 PM
Targeting universities, companies and governmental entities
2013 - 2017
In 2018, a US Department of Justice (DOJ) indictment was filed against nine Iranian hackers who had operated for Silent Librarian. According to the indictment, during the campaign that ran from 2013 until at least December 2017 more than 140 US universities, 30 US companies and five US government agencies were compromised by this threat actor. Furthermore, 176 other universities in 21 foreign countries were compromised. All academic disciplines were targeted[12].
During this period, Silent Librarian demonstrated their capacity to deploy sophisticated phishing campaigns. Their phishing emails were contextually accurate, appeared authentic, and they were grammatically correct[13]. Furthermore, their credential harvesting pages were almost identical to the legitimate pages. According to Phishlabs, Silent Librarian kept their phishing consistent over the course of this campaign[14].
January 1, 2022
16:00 PM
Undeterred Librarians
2018
After the March 2018 indictments, Silent Librarian did not slow down and kept targeting universities worldwide. Between May and August 2018, the group was building their infrastructure by registering domain names. These domain registrations indicate that the March 2018 indictments did not have a significant deterring effect on them. With this campaign, the group was observed targeting at least 76 universities located in 14 countries[15].
Then in August 2018, Silent Librarian was found to be spoofing login pages for university libraries across the world[16]. Although there is no evidence available on the delivery method of the spoofed websites for this campaign, the extensive usage of sophisticated phishing during previous campaigns make it likely that in their 2018 campaign, they also used phishing to persuade university students or employees to visit and log in to the spoofed websites[17].
January 1, 2022
16:00 PM
The library needs to be stocked
2019
In 2019, Proofpoint reported a new phishing campaign by Silent Librarian, targeting universities between June 2019 and October 2019[18]. According to New Jersey Cybersecurity & Communications Integration Cell, the campaign was focused on stealing intellectual property from universities[19].
The phishing e-mails that were sent during the campaign contained details about university library accounts. This modus operandi was similar to their 2018 campaign; a specific example is an e-mail in which the recipient was asked to click on an embedded link because of the expiration of their university library account. The link then lead to a spoofed website, asking for credentials. Silent Librarian leveraged external events, such as publicized weather and downtime alerts to enhance the email’s credibility (see Figure 1). They also used compromised university e-mail accounts to send phishing e-mails to other universities, further ensuring their effectiveness. From a resource and infrastructure perspective, it was found that the group uses URL shorteners[20], which makes it more difficult to detect the malicious e-mails.
Figure 1. Malicious university login portal, containing an accurate weather downtime alert | Source: Proofpoint.
.
January 1, 2022
16:00 PM
The Librarian’s attempt to expand
2020
Throughout 2020, threat intelligence company Recorded Future reported an increase in the pace of operational activity by the threat actor[22]. Their report also states that Silent Librarian’s TTPs remained mostly unchanged within this time period.
The group was active mostly during the start of the academic year of 2020-2021, according to Malwarebytes. They observed activity of this campaign since at least mid-September 2020. This campaign entailed similar TTPs as seen during previous campaigns. A noteworthy technique during this campaign was the swapping of top-level domain names in order to make their phishing websites appear legitimate[23]. This is done by registering domain names that are very similar or identical to the original domain, except for the top level domain name (.nl/.com/.org), which is changed.
This campaign was different from previous campaigns due to an external factor: COVID-19. Students and staff worked remotely which in turn increased their engagement with digital platforms and therefore made successful phishing emails more likely.
January 1, 2022
16:00 PM
Operating in silence?
2021 - 2023
Since the last campaign in 2020, no large clusters of activity of the threat actor have been observed. This does not directly indicate that their campaigns have stopped altogether, rather it is possible that they have adapted their TTPs, attempting to operate more under the radar. There is one observation by Recorded Future, according to which network communications between known infrastructure of Silent Librarian and academic institutions in Spain and Switzerland were detected between February and March 2021 [24].
January 1, 2022
16:00 PM
Campaigns summary
Silent Librarian has been actively targeting organizations since 2013 until at least 2021. Over the past decade, Silent Librarian victimized hundreds of universities worldwide, and numerous private companies and government sector organizations.
Noteworthy is the timing of Silent Librarian’s attacks against universities; they tend to time their operations during the summer and the beginning of an academic year. They likely try to take advantage of the chaos of the new academic year during this period[25]. During these campaigns, a recurring feature was (library themed) phishing attacks on universities worldwide.
