Loading story…
Muddled Libra—also tracked as Scattered Spider and UNC3944—resumed intrusion activity with faster, broader operations across government, retail, insurance, and aviation organizations, relying heavily on voice-based social engineering to manipulate help desks and users into resetting credentials and MFA. Investigators reported the group often minimizes malware use, abuses legitimate tools and victim-owned assets, and can move from initial access to high privilege extremely quickly, including one case where domain administrator access was reached in about 40 minutes. Since at least April 2025, the actor has also worked with the DragonForce ransomware-as-a-service program, with incidents involving large-scale data theft followed by encryption.
Separate technical analysis tied the group to the bedevil (bdvl) Linux userland rootkit used against VMware vCenter servers, where it hides LD_PRELOAD persistence by patching dynamic linker binaries to reference a randomly generated preload path instead of /etc/ld.so.preload. The technique is designed to evade normal inspection tools and can restore the original linker path during uninstall or backdoor-triggered cleanup. Researchers said defenders can uncover the hidden preload path by tracing the first file access of dynamically linked binaries and can identify tampering through package integrity checks such as rpm -V glibc or debsums, while stronger Microsoft Entra ID Conditional Access policies can materially slow the group’s cloud-focused operations and reduce ransomware impact.
Get the infrastructure and lures behind it.
6 events from the most recent confirmed update back to the earliest known activity.
Since at least April 2025, Muddled Libra has partnered with the DragonForce ransomware-as-a-service program. Unit 42 linked this partnership to extortion activity including data theft and encryption.
In 2025, Muddled Libra resumed intrusion operations after 2024 disruption efforts, with Unit 42 assessing the group had become further-reaching, faster, and more impactful. The group targeted organizations in the government, retail, insurance, and aviation sectors.
Federal charges were levied against five suspected Muddled Libra members in November 2024. This was part of broader efforts to disrupt the threat group.
In 2024, Palo Alto Networks Unit 42 reported that Muddled Libra used the Linux userland rootkit bedevil to target VMware vCenter servers. The rootkit used dynamic linker patching to hide LD_PRELOAD persistence more stealthily.
International law enforcement operations disrupted Muddled Libra in mid-to-late 2024, according to Unit 42's assessment of the group's activity. The disruption preceded the group's later return in 2025.
Recent arrests involved four individuals connected to cyberattacks against three UK-based retailers, cited by Unit 42 as related law enforcement action in this threat landscape. The reference does not provide a more specific date for the arrests.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported that during a **September 2025** incident response engagement, investigators identified a **rogue virtual machine** created inside a victim’s **VMware vSphere** environment and attributed the activity with **high confidence** to **Muddled Libra** (aka **Scattered Spider**, **UNC3944**). After gaining unauthorized access to vSphere, the actor used the VM as a low-noise staging point to conduct reconnaissance, download tools, and establish persistence via a C2 channel, consistent with the group’s pattern of blending into victim infrastructure and relying on legitimate administrative capabilities rather than heavy custom malware. The intrusion chain described includes rapid post-access interaction with vSphere (roughly hours after initial access), creation of a new VM, and subsequent use of **stolen certificates** to expand control (including ticket-forging activity). The actor then targeted identity infrastructure by powering down **virtualized domain controllers**, mounting their `VMDK`s, and copying `NTDS.dit` and `SYSTEM` to the rogue VM, followed by directory discovery (e.g., **ADRecon** and review of service principal names). The reporting also notes interaction with the victim’s **Snowflake** environment and attempted data movement (including mailbox/PST-related activity), plus persistence using an SSH tunnel via **Chisel** delivered as a ZIP (e.g., `goon.zip`) from attacker-controlled infrastructure (including AWS S3) and outbound communications over TCP 443.
Jun 29, 2026
**Scattered Spider**—also tracked as `UNC3944`, `0ktapus`, `Muddled Libra`, and `Scatter Swine`—has broadened its operations from telecom-focused credential theft and SIM swapping into ransomware, extortion, and cloud-centric intrusions across hospitality, retail, media, financial services, BPOs, and parts of critical infrastructure. Reporting links the group to major incidents involving **Twilio**, **Okta** customers, **Coinbase**, **Reddit**, **Riot Games**, **Ubiquiti**, and **MGM Resorts**, where attackers used convincing phone calls, SMS phishing, MFA fatigue, and IT help-desk impersonation to steal credentials and gain privileged access. Researchers say the group routinely abuses legitimate remote administration tools including **AnyDesk**, **LogMeIn**, and **ConnectWise Control**, while also using malware such as **POORTRY** and **STONESTOP** to disable security controls and maintain access across **Azure**, **Microsoft 365**, **Google Workspace**, **AWS**, **Windows**, and **Linux** environments. Defenders have been urged to audit and restrict remote access software, review logs for unauthorized execution, harden MFA enrollment and help-desk identity verification, and monitor for in-memory loading, suspicious MFA registration, and data exfiltration activity tied to the group’s tradecraft.
Aug 15, 2026
Multiple reports highlight active **Windows-focused malware** operations centered on credential theft and payload delivery. **Socelars** is described as a stealthy infostealer that prioritizes harvesting browser-stored session cookies and authentication artifacts (notably targeting *Facebook Ads Manager* sessions) to enable account takeover and fraud; it is reportedly distributed via fake websites posing as legitimate software (e.g., a PDF reader) and uses staged execution including system reconnaissance and a **UAC bypass via COM auto-elevation** before extracting browser session data for exfiltration. Separately, research details how established malware delivery ecosystems are evolving. Zscaler ThreatLabz reports **GuLoader (CloudEye)** increasingly abuses legitimate cloud services (e.g., *Google Drive* and *OneDrive*) to blend malicious downloads into normal traffic, while using polymorphism and control-flow obfuscation plus layered decryption to hinder analysis and deliver follow-on payloads such as RATs and stealers. Bitdefender reports a resurgence of **LummaStealer** despite prior law-enforcement disruption, attributing continued scale to social-engineering-heavy distribution (fake cracks/downloads and **fake CAPTCHA/“ClickFix”** lures) and the use of **CastleLoader** for modular, in-memory execution and obfuscated delivery; the report notes infrastructure overlap suggesting coordination or shared providers. A separate Unit 42 incident-response writeup on **Muddled Libra (Scattered Spider/UNC3944)** describes a distinct intrusion tradecraft involving unauthorized access to a *VMware vSphere* environment and a rogue VM used for reconnaissance, persistence, and interaction with enterprise infrastructure, and is not part of the infostealer/loader activity described in the other items.
Jun 29, 2026