Silent_Librarian__2020__Silent_Librarian_APT_right_on_schedule_for_20_21_academic_year_-_Malwarebytes_Labs_Malwarebytes_Labs.pdf

A threat actor known as Silent Librarian/TA407/COBALT DICKENS is conducting spear-phishing campaigns against universities worldwide, repeatedly aligning campaigns with academic calendars. The report details phishing domains, domain registrations, and infrastructure (including Iran-based hosting), and lists multiple university targets with example phishing sites, indicating an ongoing, credible campaign by a well-funded group.