Loading story…
Palo Alto Networks Unit 42 reported that during a September 2025 incident response engagement, investigators identified a rogue virtual machine created inside a victim’s VMware vSphere environment and attributed the activity with high confidence to Muddled Libra (aka Scattered Spider, UNC3944). After gaining unauthorized access to vSphere, the actor used the VM as a low-noise staging point to conduct reconnaissance, download tools, and establish persistence via a C2 channel, consistent with the group’s pattern of blending into victim infrastructure and relying on legitimate administrative capabilities rather than heavy custom malware.
The intrusion chain described includes rapid post-access interaction with vSphere (roughly hours after initial access), creation of a new VM, and subsequent use of stolen certificates to expand control (including ticket-forging activity). The actor then targeted identity infrastructure by powering down virtualized domain controllers, mounting their VMDKs, and copying NTDS.dit and SYSTEM to the rogue VM, followed by directory discovery (e.g., ADRecon and review of service principal names). The reporting also notes interaction with the victim’s Snowflake environment and attempted data movement (including mailbox/PST-related activity), plus persistence using an SSH tunnel via Chisel delivered as a ZIP (e.g., goon.zip) from attacker-controlled infrastructure (including AWS S3) and outbound communications over TCP 443.
Get the actors, campaigns, and ATT&CK mapping behind it.
7 events from the most recent confirmed update back to the earliest known activity.
On 2026-02-10, Palo Alto Networks Unit 42 publicly detailed the September 2025 incident and attributed the activity with high confidence to Muddled Libra, also known as Scattered Spider or UNC3944. The report highlighted the group's use of living-off-the-land techniques, identity abuse, and recommendations for stronger identity controls and monitoring.
After about 15 hours of observed attacker activity, the victim's security team cut off the attackers' access and ended the intrusion. Microsoft Defender on the rogue VM had reportedly detected several of the tools used during the operation.
During the same intrusion, the attackers interacted with the victim's Snowflake environment and attempted to exfiltrate data through multiple file-sharing services. They also tried uploading an Outlook PST file to an attacker-controlled AWS S3 bucket using S3 Browser.
From the rogue VM, the group set up an SSH tunnel with Chisel for persistence and carried out extensive enumeration using tools such as ADRecon and ADExplorer. They also used legitimate administrative utilities including RDP and PsExec to blend in while moving through the environment.
Using vSphere access, the attackers powered down domain controllers, mounted their VMDKs, and copied NTDS.dit and SYSTEM hive files to the rogue VM. This enabled extraction and decryption of Active Directory credential material and helped expand their control.
Roughly two hours after initial access in the September 2025 incident, the attackers entered the victim's VMware vSphere environment and created a rogue virtual machine named "New Virtual Machine." The VM was used as an internal beachhead for reconnaissance, tool staging, persistence, and lateral movement.
In September 2025, Muddled Libra obtained unauthorized access to the victim environment by targeting help desk or call center processes, according to Unit 42's assessment. The intrusion relied on identity abuse and social engineering rather than a novel exploit.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Muddled Libra**—also tracked as **Scattered Spider** and `UNC3944`—resumed intrusion activity with faster, broader operations across government, retail, insurance, and aviation organizations, relying heavily on voice-based social engineering to manipulate help desks and users into resetting credentials and MFA. Investigators reported the group often minimizes malware use, abuses legitimate tools and victim-owned assets, and can move from initial access to high privilege extremely quickly, including one case where domain administrator access was reached in about 40 minutes. Since at least April 2025, the actor has also worked with the **DragonForce** ransomware-as-a-service program, with incidents involving large-scale data theft followed by encryption. Separate technical analysis tied the group to the **bedevil** (`bdvl`) Linux userland rootkit used against **VMware vCenter** servers, where it hides `LD_PRELOAD` persistence by patching dynamic linker binaries to reference a randomly generated preload path instead of `/etc/ld.so.preload`. The technique is designed to evade normal inspection tools and can restore the original linker path during uninstall or backdoor-triggered cleanup. Researchers said defenders can uncover the hidden preload path by tracing the first file access of dynamically linked binaries and can identify tampering through package integrity checks such as `rpm -V glibc` or `debsums`, while stronger Microsoft Entra ID Conditional Access policies can materially slow the group’s cloud-focused operations and reduce ransomware impact.
Aug 1, 2026
Lazarus-linked operators exploited unpatched **VMware Horizon** servers vulnerable to **Log4Shell** (`CVE-2021-44228`) to compromise organizations, with reporting tying the activity to energy-sector victims in the United States, Canada, and Japan as well as broader targeting of Japanese entities. After initial access, the attackers deployed multiple backdoors and RATs including **VSingle**, **YamaBot**, **MagicRAT**, and **NukeSped**, then carried out hands-on-keyboard actions such as disabling security tools, creating unauthorized accounts, harvesting credentials, enumerating Active Directory, moving laterally with Windows administration utilities and Impacket, and exfiltrating selected files. Separate reporting also found the same exposed Horizon systems had been abused by other actors to install a Monero miner, underscoring how quickly internet-facing Log4Shell targets were reused. The malware set showed a mix of Windows and Linux capability and several methods for blending command-and-control into normal web traffic. **VSingle** supported remote command execution and file transfer, and newer Linux variants could fall back to **GitHub** to retrieve replacement C2 addresses when hard-coded servers failed, using repository content to locate attacker infrastructure. **YamaBot**, a Golang backdoor for both Windows and Linux, exchanged RC4- and Base64-protected data through HTTP cookies and could disguise larger exfiltration as BMP-like multipart content, while **NukeSped** provided modular espionage functions including shell access, file management, keylogging, screen capture, and tunneling. Researchers attributed the campaign to Lazarus based on malware overlaps, infrastructure links, and tradecraft consistent with prior North Korean espionage operations.
Aug 15, 2026
**Scattered Spider**—also tracked as `UNC3944`, `0ktapus`, `Muddled Libra`, and `Scatter Swine`—has broadened its operations from telecom-focused credential theft and SIM swapping into ransomware, extortion, and cloud-centric intrusions across hospitality, retail, media, financial services, BPOs, and parts of critical infrastructure. Reporting links the group to major incidents involving **Twilio**, **Okta** customers, **Coinbase**, **Reddit**, **Riot Games**, **Ubiquiti**, and **MGM Resorts**, where attackers used convincing phone calls, SMS phishing, MFA fatigue, and IT help-desk impersonation to steal credentials and gain privileged access. Researchers say the group routinely abuses legitimate remote administration tools including **AnyDesk**, **LogMeIn**, and **ConnectWise Control**, while also using malware such as **POORTRY** and **STONESTOP** to disable security controls and maintain access across **Azure**, **Microsoft 365**, **Google Workspace**, **AWS**, **Windows**, and **Linux** environments. Defenders have been urged to audit and restrict remote access software, review logs for unauthorized execution, harden MFA enrollment and help-desk identity verification, and monitor for in-memory loading, suspicious MFA registration, and data exfiltration activity tied to the group’s tradecraft.
Aug 15, 2026