Threat Group Assessment: Muddled Libra (Updated May 16, 2025)
Summary: Unit 42 attributes interrelated incidents from mid-2022 through early 2024 to Muddled Libra, a group that targets IT helpdesks with social engineering and, in under a few minutes, changed an account password and reset a victim's MFA to gain network access. The group began with large business process outsourcing firms serving high-value cryptocurrency holders, moved to a ransomware affiliate model, and has since added a DragonForce ransomware-as-a-service affiliation and expanded targeting to technology, hospitality and financial industries.
Key Takeaway: Muddled Libra has joined incident response war rooms and created email security rules to intercept and redirect IR-related communication, so the responders trying to expel them may be working alongside them. Unit 42 also notes key members were arrested over the past year, yet others with new skills and inside knowledge of new industries quickly moved in to take their place.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026