Muddled Libra’s Evolution to the Cloud
Summary: Unit 42 researchers report that the Muddled Libra group now targets SaaS applications and cloud service provider environments, first observed late in 2023 with activity as recent as January 2024. The group performs reconnaissance to identify administrative users, social engineers help desks for initial access, exploits identity providers such as Okta to escalate privileges, and uses legitimate AWS services including DataSync and AWS Transfer to move data out of environments.
What you should know: Muddled Libra turns your own cloud tooling against you: AWS DataSync and AWS Transfer, built to move data quickly, can move it straight to an external entity, and Azure VM snapshots can image hosts holding sensitive data. The group's entry point is often a help desk call targeting an administrator whose SSO portal lists your SIEM, EDR and password management system.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026