A Peek Into Muddled Libra’s Operational Playbook
Summary: Unit 42 recovered a rogue VM created by Muddled Libra (Scattered Spider, UNC3944) after the group gained access to a client's VMware vSphere environment in a September 2025 incident response engagement. About two hours after initial access the attackers built the VM as a beachhead, then used stolen certificates to forge tickets, pulled NTDS.dit and SYSTEM hives from two powered-down domain controllers, ran ADRecon, and moved data from a Snowflake database before their access was cut off after roughly 15 hours.
What's compelling: The group's edge is not malware but identity: forged tickets, compromised accounts, and legitimate tools like Chisel, PsExec and ADExplorer pulled straight from Microsoft's SysInternals domain. A single VM built inside your own vSphere, with default Defender as the only thing that flagged ADRecon and Chisel, is what 15 hours of undetected lateral movement looks like.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026