Muddled Libra

Muddled Libra, a threat actor subgroup known for its sophisticated cyber-attack techniques, has recently been noted for its advanced exfiltration and discovery methods using AWS and Azure cloud services. The group has not claimed responsibility for any specific attacks, but their tactics align closely with those used by the cybercrime group codenamed Scattered Spider, also known as UNC3944, 0ktapus, Octo Tempest, Scatter Swine, and Muddled Libra. This implies that they may have been involved in recent high-profile cyber-attacks such as the MoneyGram attack. Their constantly evolving attack strategies make them a significant threat to cybersecurity, yet understanding their end goals can help defenders build better protections. In terms of specific techniques, Muddled Libra exploits legitimate cloud service provider (CSP) features to efficiently exfiltrate data. In AWS environments, they target two legitimate services, AWS DataSync and AWS Transfer, to move data from an on-premises environment to the cloud and then to an external entity. For Azure environments, Muddled Libra uses traditional VM functionality known as snapshots to take images of hosts containing sensitive information. They then create new VMs within the compromised environment, save operational data from the snapshots to these new hosts for staging, and subsequently exfiltrate the data. The Muddled Libra threat actor group is known for its complex attack chain, particularly in the cloud. By leveraging legitimate CSP services and creating new VMs within compromised environments, they can efficiently stage and exfiltrate data. Despite their ever-changing tactics, understanding their ultimate objectives can guide the implementation and improvement of technology protections to safeguard environments against such threats. However, their alignment with the tactics of other known cybercrime groups suggests that they are part of a larger network of malicious actors, making them a persistent and significant threat to cybersecurity.