Loading story…
Palo Alto Networks Unit 42 published an updated assessment of Muddled Libra, outlining the threat group’s activity, tradecraft, and evolving risk profile. The report identifies the actor as a tracked intrusion set and refreshes prior intelligence with new findings intended to help defenders understand how the group operates and where it may pose the greatest threat.
The update serves as a current intelligence reference for security teams monitoring Muddled Libra-linked operations, consolidating attribution context and operational patterns into a single threat assessment. For CISOs and defenders, the publication highlights the need to review detections, hunting priorities, and response readiness against the group’s known tactics, techniques, and procedures.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 published an updated threat group assessment for Muddled Libra. The reference indicates the update was released on May 16, 2025.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Muddled Libra**—also tracked as **Scattered Spider** and `UNC3944`—resumed intrusion activity with faster, broader operations across government, retail, insurance, and aviation organizations, relying heavily on voice-based social engineering to manipulate help desks and users into resetting credentials and MFA. Investigators reported the group often minimizes malware use, abuses legitimate tools and victim-owned assets, and can move from initial access to high privilege extremely quickly, including one case where domain administrator access was reached in about 40 minutes. Since at least April 2025, the actor has also worked with the **DragonForce** ransomware-as-a-service program, with incidents involving large-scale data theft followed by encryption. Separate technical analysis tied the group to the **bedevil** (`bdvl`) Linux userland rootkit used against **VMware vCenter** servers, where it hides `LD_PRELOAD` persistence by patching dynamic linker binaries to reference a randomly generated preload path instead of `/etc/ld.so.preload`. The technique is designed to evade normal inspection tools and can restore the original linker path during uninstall or backdoor-triggered cleanup. Researchers said defenders can uncover the hidden preload path by tracing the first file access of dynamically linked binaries and can identify tampering through package integrity checks such as `rpm -V glibc` or `debsums`, while stronger Microsoft Entra ID Conditional Access policies can materially slow the group’s cloud-focused operations and reduce ransomware impact.
Aug 1, 2026
Palo Alto Networks Unit 42 reported on **Automated Libra**, a threat activity cluster that uses automation and likely AI-assisted social engineering to support cyber intrusions. The reporting indicates the actor focuses on manipulating targets through convincing interactions rather than relying solely on malware delivery, highlighting a growing operational model in which adversaries blend traditional intrusion tradecraft with scalable, automated engagement. The activity underscores how threat actors are adapting generative AI and workflow automation to improve phishing, impersonation, and other human-targeted tactics that can lead to credential theft or broader compromise. Unit 42’s publication frames Automated Libra as part of a wider shift in the threat landscape, where attackers use automated tooling to increase the speed, volume, and plausibility of social-engineering operations against organizations.
Jul 12, 2026
Palo Alto Networks Unit 42 reported that during a **September 2025** incident response engagement, investigators identified a **rogue virtual machine** created inside a victim’s **VMware vSphere** environment and attributed the activity with **high confidence** to **Muddled Libra** (aka **Scattered Spider**, **UNC3944**). After gaining unauthorized access to vSphere, the actor used the VM as a low-noise staging point to conduct reconnaissance, download tools, and establish persistence via a C2 channel, consistent with the group’s pattern of blending into victim infrastructure and relying on legitimate administrative capabilities rather than heavy custom malware. The intrusion chain described includes rapid post-access interaction with vSphere (roughly hours after initial access), creation of a new VM, and subsequent use of **stolen certificates** to expand control (including ticket-forging activity). The actor then targeted identity infrastructure by powering down **virtualized domain controllers**, mounting their `VMDK`s, and copying `NTDS.dit` and `SYSTEM` to the rogue VM, followed by directory discovery (e.g., **ADRecon** and review of service principal names). The reporting also notes interaction with the victim’s **Snowflake** environment and attempted data movement (including mailbox/PST-related activity), plus persistence using an SSH tunnel via **Chisel** delivered as a ZIP (e.g., `goon.zip`) from attacker-controlled infrastructure (including AWS S3) and outbound communications over TCP 443.
Jun 29, 2026