Shadow Academy
Shadow Academy is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets the Education and Research sector in 4 countries, including the United States and the United Kingdom.
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2020
- Record updated
Who They Target.
About Shadow Academy.
In early July 2020, RiskIQ began tracking a phishing campaign identified through our internet intelligence graph targeting colleges and universities worldwide. From July 2020 into October 2020, RiskIQ systems uncovered 20 unique targets in Australia, Afghanistan, the UK, and the USA. All these attacks used similar tactics, techniques, and procedures (TTPs) as {{Mabna Institute, Cobalt Dickens, Silent Librarian}}, an Iranian company that, according to the FBI, was created for illegally gaining access 'to non-Iranian scientific resources through computer intrusions.' Mabna Institute earned the moniker 'Silent Librarian' due to its focused efforts to compromise university students and faculty by impersonating university library resources using domain shadowing to harvest credentials. However, while RiskIQ's findings are consistent with TTPs in use by Silent Librarian, they alone are not sufficient to attribute the threat activity we've detected against these 20 universities directly to Mabna Institute. Therefore, RiskIQ has named actors identified during this research as 'Shadow Academy.'.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.