Novel Technique to Detect Cloud Threat Actor Operations
Summary: Unit 42 researchers mapped cloud alert events to MITRE ATT&CK techniques for two threat groups, the cybercrime group Muddled Libra and the nation-state group Silk Typhoon, and found the groups trigger distinct alert patterns: Muddled Libra has nearly 70 alert types and Silk Typhoon more than 50, with only 3 in common. Using alert data from June 2024 to June 2025, the analysis also correlated those patterns with the industries each group targets, and the test confirmed security teams could distinguish the two groups based solely on the types of alerts observed.
Why it matters: The research sets a concrete threshold: more than 10 unique Muddled Libra-associated alerts within a 30-day window warrants deeper investigation, regardless of whether your industry is currently trending in threat intelligence. It also flags that manufacturing, pharma and life sciences, and state and local government showed 16 or more unique alert types tied to the group's fingerprint, suggesting interest in environments that haven't made headlines.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026