Adept Libra

Adept Libra, also known as TeamTNT, is a malicious threat actor that has been active in cybersecurity breaches since at least July 2021. The group is known for its innovative use of tools such as LaZagne to steal passwords from various operating systems, including Linux distributions in cloud-based environments. This was notably observed during the Chimaera campaign. In December 2021, Adept Libra continued its nefarious activities by exploiting LaZagne to steal passwords from a WordPress site hosted in a Kubernetes environment. The group's modus operandi includes targeting vulnerable Redis instances and deploying worm-like operations. However, it differentiates itself from other threat actors like Thief Libra (aka WatchDog), Automated Libra (aka PurpleUrchin), Money Libra (aka Kinsing), and others, through its unique infection vectors. For instance, unlike the P2PInfect worm that exploits Redis through CVE-2022-0543, Adept Libra's methods are not commonly found among other cryptojacking-focused worms known to target Redis instances. Despite the similarities in attack patterns with other groups, there are no confirmed links between Adept Libra and other threat actor groups known for targeting Redis and deploying worms. This suggests that Adept Libra operates independently, further complicating efforts to predict and prevent their attacks. It is crucial for organizations to stay vigilant and maintain robust security measures to mitigate the potential risks posed by this threat actor.