CyberWire Daily Muddled Libra: From Spraying to Preying in 2025 [Threat Vector]
33 snips
Jul 26, 2025 In this engaging discussion, Kristopher Russo, a principal threat researcher at Unit 42, and Sam Rubin, the head of Unit 42 with over 20 years of cyber expertise, delve into the rising threat posed by the Muddled Libra group. They explore the shift to destructive extortion tactics and cloud-first strategies that make traditional defenses obsolete. Real-world examples emphasize the need for robust cybersecurity measures, including a focus on zero trust principles and enhancing internal trust models to combat today's sophisticated threats.
AI Snips
Chapters
Transcript
Episode notes
Muddled Libra Evolution and Tactics
- Muddled Libra evolved from a small crypto-focused group to modular teams targeting diverse objectives like ransomware and phishing.
- They rely heavily on social engineering, especially targeting humans as the hardest-to-patch operating system.
Block Muddled Libra with Conditional Access
- Implement strong conditional access policies to block attackers even if they gain initial access via social engineering.
- Use zero trust principles like least privilege and identity management tools to enforce layered defenses.
Help Desk Duped but Stopped
- In one Muddled Libra incident, help desk staff unknowingly aided attackers but were blocked by conditional access.
- Despite being duped, even attackers couldn't bypass multi-factor controls, highlighting their effectiveness.