Rogue VM Linked to Muddled Libra in VMware vSphere Attack, Exposing Critical TTPs
The cybercrime group known as Muddled Libra, also referred to as Scattered Spider or UNC3944, has been observed utilizing a rogue virtual machine (VM) to execute their attacks. This VM provided insight into their operational methods, including…
The cybercrime group known as Muddled Libra, also referred to as Scattered Spider or UNC3944, has been observed utilizing a rogue virtual machine (VM) to execute their attacks. This VM provided insight into their operational methods, including reconnaissance, credential theft, and lateral movement using legitimate tools.
Muddled Libra is recognized for utilizing aggressive social engineering tactics, such as smishing and vishing, to gain initial access to organizations. They often target call centers, business process outsourcers (BPOs), and managed service providers (MSPs). Their approach focuses on exploiting identity workflows and leveraging an organization’s infrastructure for attacks, rather than relying heavily on malware.
In a September 2025 incident, analysts discovered a rogue VM within a victim's VMware vSphere environment. This VM served as a beachhead for attackers, revealing their step-by-step approach to breaching systems and gathering sensitive information.
After gaining access, attackers logged into the vSphere portal and created a VM named "New Virtual Machine." They used the local Administrator account as their main access point. The attackers downloaded stolen certificates to forge tickets and move through the network while appearing legitimate. Persistence was established with an SSH tunnel using the Chisel tool, maintaining a command-and-control connection over TCP port 443 for approximately 15 hours. The group accessed Active Directory, powered down virtualized domain controllers, and copied sensitive data to the rogue VM.
This VM provided insight into their operational methods, including reconnaissance, credential theft, and lateral movement using legitimate tools.
Attackers extracted detailed information from Active Directory and other critical services. They researched the victim’s business profile to determine valuable data for exfiltration. Data from the target's Snowflake environment was pulled into the rogue VM for potential exfiltration.
Organizations should monitor VMware vSphere, ESXi, and Snowflake activities for unusual VM creation, domain controller shutdowns, and bulk access to Active Directory or databases. Enhanced detection capabilities for identity-based attacks and living-off-the-land techniques are crucial.
Implement identity-centric controls and strict administrative access policies. Utilize layered security solutions to detect malicious tools and suspicious activities. Monitor for anomalous cloud operations and tunneling patterns associated with threat groups like Muddled Libra.
For further information on cybersecurity measures, visit Palo Alto Networks .
Based on reporting by GBHackers.