Muddled Libra

Muddled Libra is a notable threat actor known for its sophisticated use of cloud services, particularly Amazon Web Services (AWS) and Microsoft Azure, to execute cyberattacks. The group leverages legitimate cloud service provider (CSP) features to efficiently exfiltrate data. In AWS, Muddled Libra targets two key services: AWS DataSync and AWS Transfer. These services are used to shift data from an on-premises environment to the cloud, and subsequently to an external entity. This method allows Muddled Libra to quickly move large volumes of data while blending into regular network traffic, making their activities harder to detect. In addition to AWS, Muddled Libra has demonstrated proficiency in exploiting Microsoft Azure's functionalities. One such technique involves the use of traditional Virtual Machine (VM) snapshots to capture images of hosts containing sensitive information relevant to the group’s attack objectives. To avoid detection, Muddled Libra creates new VMs within the compromised environment, saves operational data from the snapshots to these new hosts for staging, and then exfiltrates the data. This approach not only conceals their activities but also provides them with a means to persist within the target environment. Despite Muddled Libra's constantly evolving tactics, understanding their end goals can aid in building more robust defenses. By studying their attack chain, defenders can implement and improve technological protections to safeguard their environments. For instance, monitoring for abnormal use of AWS DataSync, AWS Transfer, and Azure VM snapshot functionalities could help identify potential threats. While Muddled Libra's techniques present significant challenges, through vigilance and continuous adaptation, organizations can mitigate the risks posed by this threat actor.