Muddled Libra Threat Assessment: Further-Reaching, Faster, More Impactful
Summary: Unit 42 reports that Muddled Libra (also tracked as Scattered Spider and UNC3944) returned in 2025 with faster, further-reaching intrusions after international law enforcement actions in mid-to-late 2024, including federal charges against five suspected members in November 2024. In 2025 cases the group shifted from smishing and phishing to direct voice-based social engineering of help desks, with over 70% of the numbers it used leveraging Google Voice, and averaged 1 day, 8 hours and 43 minutes from initial access to containment.
Why it matters: Unit 42 observed the group move from a help-desk social engineering call to domain administrator rights in about 40 minutes, and since at least April 2025 it has partnered with the DragonForce RaaS program, exfiltrating over 100 GB in a two-day period in one case before deploying ransomware.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026