[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/threat-group-assessment-muddled-libra-2024/) * [Spanish (LATAM)](https://unit42.paloaltonetworks.com/es-la/threat-group-assessment-muddled-libra-2024/) * [French](https://unit42.paloaltonetworks.com/fr/threat-group-assessment-muddled-libra-2024/) * [Japanese](https://unit42.paloaltonetworks.com/ja/threat-group-assessment-muddled-libra-2024/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/ "Threat Actor Groups") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # Threat Group Assessment: Muddled Libra (Updated May 16, 2025) ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 15 min read Related Products [![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![App-ID icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)App-ID](https://unit42.paloaltonetworks.com/product-category/app-id/ "App-ID")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Cortex XSIAM icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSIAM](https://unit42.paloaltonetworks.com/product-category/cortex-xsiam/ "Cortex XSIAM")[![Cortex XSOAR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSOAR](https://unit42.paloaltonetworks.com/product-category/cortex-xsoar/ "Cortex XSOAR")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Amer Elsad](https://unit42.paloaltonetworks.com/author/amer-elsad/) * [Kristopher Russo](https://unit42.paloaltonetworks.com/author/kristopher-russo/) * [Austin Dever](https://unit42.paloaltonetworks.com/author/austin-dever/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:May 16, 2025 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [0ktapus](https://unit42.paloaltonetworks.com/tag/0ktapus/) * [ALPHV](https://unit42.paloaltonetworks.com/tag/alphv/) * [App-ID](https://unit42.paloaltonetworks.com/tag/app-id/) * [BlackCat ransomware](https://unit42.paloaltonetworks.com/tag/blackcat-ransomware/) * [MITRE](https://unit42.paloaltonetworks.com/tag/mitre/) * [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/) * [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/) * [Scatter Swine](https://unit42.paloaltonetworks.com/tag/scatter-swine/) * [Scattered Spider](https://unit42.paloaltonetworks.com/tag/scattered-spider/) * [Social engineering](https://unit42.paloaltonetworks.com/tag/social-engineering/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/threat-group-assessment-muddled-libra-2024/?pdf=download&lg=en&_wpnonce=04e1ae3768 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/threat-group-assessment-muddled-libra-2024/?pdf=print&lg=en&_wpnonce=04e1ae3768 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)]( "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fthreat-group-assessment-muddled-libra-2024%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)]( "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)]( "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fthreat-group-assessment-muddled-libra-2024%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)]( "Share in Mastodon") ## Executive Summary **Update May 16, 2025:** We've added an additional section to this article that describes the evolution of Muddled Libra activity since the beginning for 2024. This group is a dynamic one, and as members cycle in and out of the group, its knowledgebase and skill set naturally shift. Its toolbox has now expanded to include: * Social engineering of both end users and helpdesks * Traditional phishing * Inside access to business process outsourcers * Ransomware affiliations for extortion Muddled Libra stands at the intersection of devious social engineering and nimble technology adaptation. With an intimate knowledge of enterprise information technology, this threat group presents a significant risk even to organizations with well-developed legacy cyber defenses. Muddled Libra's tactics can be fluid, adapting quickly to a target environment. They continue to use social engineering as their primary modus operandi, targeting a company's IT help support desk. For example, in under a few minutes, these threat actors successfully changed an account password and later reset the victim's MFA to gain access to their networks. Muddled Libra was first noted for targeting organizations in the software automation, outsourcing and telecommunications verticals. Since then, they've expanded their targeting to include the technology, business process outsourcing, hospitality and more recently, financial industries. They show no signs of slowing. Unit 42 researchers and responders have investigated interrelated incidents from mid-2022 through the beginning of 2024, which we've attributed to the threat group Muddled Libra. Initial attacks were highly structured and favored large business process outsourcing firms serving high-value cryptocurrency holders. We believe that when the threat actors exhausted those targets, they evolved into a ransomware affiliate model with extortion as their key objective. In the cases we've been involved with, we observed Muddled Libra performing the following activities: * Using NSOCKS and TrueSocks proxy services * Creating email rules to forward emails from specific security vendors to the actors to monitor communications and those helping in the investigation * Deploying a custom virtual machine into the environment * Using an open-source rootkit, bedevil ([bdvl](https://github.com/Error996/bdvl)) to target VMware vCenter servers * Gaining administrative permissions * Heavy use of anonymizing proxy services We also believe that members of Muddled Libra speak English as a first language, which provides them greater ability to conduct their social engineering attacks with other English speakers. Muddled Libra has also been observed using AI to spoof victims' voices. Social media videos can be used by attackers to train AI models. The targets we've observed seem to be primarily in the U.S. Thwarting Muddled Libra requires interweaving tight security controls, diligent awareness training and vigilant monitoring. Palo Alto Networks customers are better protected from the threats described in this article through a modern security architecture built around [Cortex XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) in concert with [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR). The [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) and [DNS Security](https://docs.paloaltonetworks.com/dns-security) [Cloud-Delivered Security Services](https://docs.paloaltonetworks.com/cdss) can help protect against command and control (C2) infrastructure, while [App-ID](https://www.paloaltonetworks.com/technologies/app-id) can limit anonymization services allowed to connect to the network. | **Related Unit 42 Topics** | [**Muddled Libra**](https://unit42.paloaltonetworks.com/tag/muddled-libra/) (related to **[Scattered Spider](https://unit42.paloaltonetworks.com/tag/scattered-spider/)** , [**Scatter Swine**](https://unit42.paloaltonetworks.com/tag/scatter-swine/)), [**0ktapus**](https://unit42.paloaltonetworks.com/tag/0ktapus), **[Social Engineering](https://unit42.paloaltonetworks.com/tag/social-engineering/)** | |----------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| ## **Update May 16, 2025** After a lull in late 2024, Muddled Libra resumed activity. Unit 42 has responded to multiple high-profile attacks, while observing even more attributed to Muddled Libra's parent group, Scattered Spider. Notably, these attacks expand on trade craft pioneered by Muddled Libra. Muddled Libra is a subset of a loosely affiliated threat collective known as Scattered Spider, Octo Tempest, Oktapus and other names. Scattered Spider's resilience lies in the breadth and diversity of its members. This group evolved in the Discord and Telegram communication platforms, drawing in members from diverse backgrounds and interests. Attackers in this group specialize in specific skill sets and work together to hone those skills to eventually sell or use in cyberattacks. Channels used by members range from crime-oriented groups like one they call The COM, to enthusiast collectives for popular online games. Muddled Libra's core members originally specialized in SIM-swapping, smishing and insider knowledge of IT systems management software. As members cycle in and out of the group, it gains new skills and sunsets less effective ones. The group's toolbox has expanded to include social engineering of both end users and helpdesks, traditional phishing, inside access to business process outsourcers and ransomware affiliations. The loose-knit and fluid nature of this group makes it inherently difficult to disrupt. Muddled Libra (see [Unit 42's Threat Assessment](https://unit42.paloaltonetworks.com/muddled-libra/) and [research on attacks against CSPs](https://unit42.paloaltonetworks.com/muddled-libra-evolution-to-cloud/)) has seen several key members arrested over the past year. However, others with new skills and inside knowledge of new industries have quickly moved in to take their place, and still others have formed entirely new threat clusters. Unit 42 has observed new offshoots with unique objectives forming to expand into previously untouched industries. These new groups are using a mix of well worn and novel techniques. Heavily targeted industries include retail and hospitality. However, favored industries and organizations can shift on a whim, and defenders in every vertical should bolster their cyber defenses against these attacks. Initial access has shifted away from smishing to social engineering. Threat actors direct social engineering attacks at helpdesks by posing as employees who have forgotten their passwords or at employees directly, with attackers claiming to be from the corporate helpdesk. Once inside the environment, attackers have leveraged free or compromised legitimate remote management tools to access customer relationship management (CRM) platforms for sensitive data exfiltration. Muddled Libra attacks have also featured virtual environment administration tools for maximum disruption. This group has a new affiliation with the ransomware-as-a-service group DragonForce for extortion. ## **Threat Overview** The attack style defining Muddled Libra appeared on the cybersecurity radar in late 2022 with the release of the 0ktapus phishing kit. This malware kit offered the following features: * A prebuilt hosting framework * Easy C2 connectivity * Bundled attack templates These options allowed attackers to emulate mobile authentication pages cheaply and easily. With over 200 realistic fake authentication portals and some targeted [smishing](https://www.paloaltonetworks.com/cyberpedia/what-is-smishing), attackers quickly gathered credentials and multifactor authentication (MFA) codes for over one hundred organizations. The speed and breadth of these attacks caught many defenders off-guard. While smishing is not a new tactic, the 0ktapus framework commoditized what would typically require complex infrastructure and advanced technical skills, in a way that granted even low-skilled attackers a high attack success rate. The sheer number of targets being hit with this kit created a fair amount of confusion regarding attribution in the research community. Previous reporting by [Group-IB](https://www.group-ib.com/blog/0ktapus/), [CrowdStrike](https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/) and [Okta](https://sec.okta.com/scatterswine) has documented and mapped many of these attacks to the following intrusion groups: 0ktapus, Scattered Spider and Scatter Swine. While these have been frequently treated as several names for one group, what these names actually define are: * An attack style using a common toolkit * A social forum-based collaboration network * An Agile-like team structure Muddled Libra is a distinct group of actors using this tradecraft. In a 2023 blog posted on ALPHV's leak site, the attackers corroborated this view, claiming that previous researcher attribution models have been non-specific. During Unit 42 Incident Response investigations, we identified several cases we attribute to Muddled Libra. Muddled Libra has been responsible for a campaign of complex supply chain attacks, ultimately leading to high-value cryptocurrency targets. This group has only intensified their campaign. They are shifting tactics to adapt to improving cyber defenses, and they are targeting to broaden their attack scope. ![Image 1 is a six-part diagram of Muddled Libra’s evolved tactics. The old tactics are in red boxes and the new tactics in green boxes.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/03/Muddled-Libra-_-New-Tactics_Revised.png) Figure 1. Muddled Libra evolved tactics. Unit 42 has observed an extensive toolkit used in these attacks. This arsenal ranges from hands-on social engineering and smishing attacks to proficiency with niche penetration testing, forensics tools and even legitimate systems management software. This breadth of tooling gives Muddled Libra an edge over even a robust and modern cyber defense plan. In incidents the Unit 42 team has investigated, Muddled Libra has been methodical in pursuing its goals and highly flexible with attack strategies. When an attack tactic is blocked, they have either rapidly pivoted to another vector or modified the target environment to enable their favored path. Muddled Libra has also repeatedly demonstrated a strong understanding of the modern incident response (IR) framework. This knowledge allows them to continue progressing toward their goals even as incident responders attempt to expel them from an environment. Once established, this threat group is difficult to eradicate. Unit 42 has observed them joining IR war rooms and creating rules within email security platforms to intercept and redirect incident response-related communication. Initially, Muddled Libra preferred targeting a victim's downstream customers using stolen data and, if allowed, would return repeatedly to the well to refresh their stolen dataset. Using this stolen data, the threat actor could return to prior victims even after the initial incident response. Furthermore, Muddled Libra appeared to have clear goals for its breaches versus just capitalizing on opportunistic access. They rapidly sought and stole information on downstream client environments and then used it to pivot into those environments. In a notable departure from earlier tactics, in 2023, intelligence indicated that Muddled Libra joined the ALPHV/Blackcat ransomware-as-a-service affiliate program. They wasted no time implementing this new tool set with a radical departure from previous tradecraft in favor of new attacks focused on data theft, encryption and enormous extortion demands. The U.S. Justice Department interrupted ALPHV's operations shortly after these attacks began. Since this action, new Muddled Libra attacks have shifted to data theft with a simple extortion objective. Muddled Libra has demonstrated a strong understanding of their victims' "line of business" processes, and they strike at the heart of business operations. ## Attack Chain While each incident is unique, Unit 42 researchers have identified enough commonalities in tradecraft to attribute multiple incidents to Muddled Libra. Figure 1 shows the attack chain. ![Image 2 is the attack chain for Muddled Libra following the MITRE ATT\&CK framework. Steps one to 11 go through reconnaissance, resource development, initial access, persistence, defense, ovation, credential, access, discovery, execution, lateral movement, collection, and finally exfiltration.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/03/word-image-89993-132966-2.png) Figure 2. Muddled Libra attack chain. We have mapped these to the MITRE ATT\&CK^®^ framework, summarized below. ### **Reconnaissance** Muddled Libra has consistently demonstrated an intimate knowledge of targeted organizations, including employee lists, job roles and cellular phone numbers. In some instances, threat actors likely obtained this data during earlier breaches against upstream targets. Threat actors also frequently obtain information packs from illicit data brokers such as the [now-defunct Genesis and Russian Markets](https://therecord.media/genesis-market-russian-market-2easy-shop-cybercrime-fraud). This data is [typically harvested from](https://therecord.media/redline-stealer-identified-as-primary-source-of-stolen-credentials-on-two-dark-web-markets)corporate and personal infected devices using malware such as Raccoon Stealer and [RedLine Stealer](https://unit42.paloaltonetworks.com/malware-configuration-extraction-techniques-guloader-redline-stealer/). With the early advent of bring-your-own-device (BYOD) policies and the popularity of hybrid work solutions, corporate data and credentials are frequently used and cached on personal devices. Decentralizing the management and protection of IT assets creates a lucrative targeting opportunity for information-stealing malware. ### **Resource Development** Lookalike domains used in smishing attacks are a consistent hallmark for Muddled Libra. This tactic is effective since mobile devices frequently truncate links in SMS messages. Malicious domain names frequently use the format of the organization name with a hyphen, followed by a service (like SSO, helpdesk or HR). Early clusters of attacks attributed to the 0ktapus campaign consistently used domains registered via Porkbun or Namecheap and hosted on Digital Ocean infrastructure. These domains are short-lived, used only during the initial access phase, and they are quickly taken down before defenders can investigate. Recently, we've observed Muddled Libra adding Metaregistrar and Hosting Concepts to their preferred registrar list, and their hosting has moved behind a large content delivery network (CDN) service. In many investigations, Unit 42 observed the use of the 0ktapus phishing kit for credential harvesting. Group-IB has done a great deep dive analysis of this versatile kit, which is widely available in the criminal underground. It requires little skill to stand up and configure, making it an ideal tool for highly targeted smishing attacks. Since its introduction, other threat groups have adopted this kit, and it continues to evolve. ### **Initial Access** In all incidents where Unit 42 could determine an initial access vector, smishing and helpdesk social engineering were involved. In most early incidents, the threat actor sent a lure message directly to the targeted employees' cellphones, claiming they needed to update account information or reauthenticate to a corporate application. Messages contained a link to a spoofed corporate domain designed to emulate a familiar login page. Likely due to organizations' large-scale phase-out of SMS as a secondary authentication factor, Muddled Libra has begun to move away from smishing as an initial entry vector. New cases indicate that this group pervasively uses direct social engineering. Helpdesk and customer service agents are particularly high-value targets. Unit 42 has observed Muddled Libra using a combination of open-source intelligence and previously compromised sensitive data to get help desk agents to reset both passwords and MFA on the same call. These attacks are convincing and persistent. They focus on wearing the agent's defenses down, running up the call length and ultimately bypassing security restrictions that could have prevented these attacks. ### **Persistence** Muddled Libra was particularly focused on maintaining access to targeted environments. While threat actors commonly use a free or demo version of a remote monitoring and management (RMM) tool during intrusions, Muddled Libra often installed half a dozen or more of these utilities. They did this to ensure they would maintain a backdoor into the environment even if one were discovered. Using commercial RMM tools is particularly problematic as these tools are legitimate, business-critical applications that Muddled Libra abuses. None of these tools are inherently malicious and they are frequently used in the day-to-day administration of many enterprise networks. Defenders should weigh the risks of an outright block versus carefully monitoring their use. Observed tools included Zoho Assist, AnyDesk, Splashtop, TeamViewer, ITarian, FleetDeck, ASG Remote Desktop, RustDesk and ManageEngine RMM. Unit 42 recommends organizations block by signer any RMM tools that they have not sanctioned for use within the enterprise. Muddled Libra has also demonstrated familiarity with cloud platforms, both hosted and software as a service (SaaS). They will use these platforms to establish a foothold within the organization, as these resources are unlikely to be monitored like traditional assets and systems. Unit 42 has a [separate article](https://unit42.paloaltonetworks.com/muddled-libra-evolution-to-cloud/) with much more detail on cloud targeting. Notably, recent attacks indicate that long-term persistence is no longer this group's primary objective. Instead, they've moved to a more traditional "encrypt and extort" model. Targeting has broadened to include large organizations more likely to have the capability to pay large ransoms. Once this group learns and understands the infrastructure and software used in an industry, they tend to target other organizations in the same vertical. ### **Defense Evasion** Demonstrating proficiency with many security controls, Muddled Libra evaded common defenses. Their tactics have included the following: * Disabling antivirus and host-based firewalls * Attempting to delete firewall profiles * Creating defender exclusions * Deactivating or uninstalling EDR and other monitoring products * Standing up unmanaged cloud virtual machines * Elevating access in virtual desktop environments Attackers also re-enabled and used existing Active Directory accounts to avoid triggering common security information and event management (SIEM) monitoring rules. We also observed them operating within endpoint detection and response (EDR) administrative consoles to clear alerts. We cover this attack in detail in [our article](https://unit42.paloaltonetworks.com/muddled-libra-evolution-to-cloud/). Muddled Libra has been careful with operational security, consistently using commercial virtual private network (VPN) services to obscure their geographic location and attempt to blend in with legitimate traffic. The group preferred Mullvad VPNin early incidents Unit 42 researchers investigated, but we also observed multiple other vendors, such as ExpressVPN, NordVPN, Ultrasurf, Easy VPN and ZenMate. Unit 42 researchers have more recently observed the usage of rotating residential proxy services as well. As reported by [Brian Krebs in 2021](https://krebsonsecurity.com/2021/03/is-your-browser-extension-a-botnet-backdoor/), residential proxy services typically hide their code inside browser extensions, allowing operators to lease out residential connections for legitimate and malicious use alike. Defenders should look for multiple users authenticating from new residential IPs over short periods. ### **Credential Access** Once attackers captured the credentials they would use for initial access, the attacker took one of two paths. In one case, they continued with the authentication process from a machine they controlled and immediately requested a MFA code. In the other cases, they generated an endless string of MFA prompts until the user accepted one out of fatigue or frustration (aka MFA bombing). In cases where MFA bombing was unsuccessful, the threat actor contacted the organization's help desk, claiming to be the victim. They would then state that their phone was inoperable or misplaced and would request to enroll a new, attacker-controlled MFA authentication device. Muddled Libra's social engineering success is notable. Across many cases, the group demonstrated unusually high comfort in engaging the help desk and other employees over the phone, convincing them to engage in unsafe actions. If targeted accounts do not have the desired access, Muddled Libra will use the account for discovery and repeat the process until they have the access necessary for their attack. After establishing a foothold, Muddled Libra moves quickly to elevate access. Standard credential-stealing tools employed in this phase included Mimikatz, ProcDump, DCSync, Raccoon Stealer and LAPS Toolkit. When the group could not quickly locate elevated credentials, they turned to Impacket, MIT Kerberos Ticket Manager and NTLM Encoder/Decoder. In some incidents, Muddled Libra employed specialized tools to search memory contents for credentials directly using MAGNET RAM Capture and Volatility. As these are legitimate forensics tools that Muddled Libra is abusing, defenders should carefully consider the downsides to blocking them, including the possibility of security team activity generating false positive alerts. This tactic raises an important flag for defenders. Even though user accounts might be protected through privileged access management, endpoints often have elevated credentials cached for system management or to run services. Care should be taken to ensure that privileged credentials only have the permissions necessary to perform their intended functions and are closely monitored for deviations from normal behavior. ### **Discovery** Muddled Libra's discovery methods were consistent from case to case. In our investigations, the group used well-known, legitimate penetration testing tools to map the environment and identify targets of interest. Their toolkit included SharpHound, ADRecon, AD Explorer, Angry IP Scanner, Angry Port Scanner and CIMplant. Muddled Libra also proved proficient with commercial systems administration tools such as ManageEngine, LANDESK and PDQ Inventory for discovery and automation. They also used VMware PowerCLI and RVTools in virtual environments. Defenders should be vigilant in identifying unsanctioned network scanning and unusual rapid access to multiple systems or access that crosses logical business segments. ### **Execution** In early incidents, Muddled Libra appeared primarily interested in data and credential theft, and we infrequently saw remote execution. However, more recent cases included a BlackCat ransomware component. When needed, the group accomplishes execution with Sysinternals PsExec or Impacket. We also observed Muddled Libra using the victim's system management tools to execute malicious code. They used captured credentials or authentication hashes for privilege elevation. ### **Lateral Movement** Muddled Libra preferred using remote desktop protocol (RDP) connections from compromised computers for lateral movement inside the target environment. This approach helps to minimize discoverable external network artifacts in logs that could alert defenders and help investigators with attribution. ### **Collection** Muddled Libra is familiar with typical enterprise data management. They've successfully located sensitive organizational data in a wide range of common data repositories, both structured and unstructured, including the following: * Confluence * Code Management Platforms * Elastic * Microsoft Office 365 suite (e.g., SharePoint, Outlook) * Internal messaging platforms They also targeted data in the victim's environment from typical service desk applications like Zendesk and Jira. Mined data included credentials for further compromise and they directly targeted sensitive and confidential information. Unit 42 researchers observed Muddled Libra using the open-source data mining tool Snaffler and native tools to search registries, local drives and network shares for keywords like \*password\*, and securestring. Threat actors then staged compromised data and archived it for exfiltration using WinRAR or PeaZip. They used stolen sensitive data as leverage in extortion demands. Defenders should regularly perform keyword searches in their environments to identify improperly stored data and credentials as part of a broader data management and classification strategy. ### **Exfiltration** In several cases, Muddled Libra attempted to establish reverse proxy shells or secure shell (SSH) tunnels for command and control exfiltration. We observed them using tunneling software such as RSocx. Muddled Libra also used common file transfer sites such as put\[.\]io, transfer\[.\]sh, wasabi\[.\]com, or gofile\[.\]io to both exfiltrate data and pull down attack tools. We also observed the use of Cyberduck as a file transfer agent. Threat actors often abuse, take advantage of or subvert legitimate products such as Cyberduck for malicious purposes. This does not necessarily imply a flaw or malicious quality to the legitimate product being abused. ### **Impact** The early impact directly observed by Unit 42 was some combination of the theft of sensitive data and Muddled Libra leveraging trusted organizational infrastructure for follow-on attacks on downstream customers. Later attacks were much more destructive, and they included the following activities: * Disruption of operations * Damage to sensitive systems * Encryption of critical data * Enormous extortion demands ## Conclusion and Mitigations Muddled Libra is a methodical adversary that substantially threatens enterprise organizations across many industries. They are proficient in a range of security disciplines, able to thrive in relatively secure environments and execute rapidly to complete devastating attack chains. Muddled Libra doesn't bring anything new to the table except for the uncanny knack of stringing together weaknesses to disastrous effect. Defenders must combine cutting-edge technology, comprehensive security hygiene and external threats and internal events monitoring. The high-stakes risk of operational disruption and loss of sensitive data is a strong incentive for modernizing information security programs. In addition to the mitigation recommendations included in the Attack Chain subsections above, we recommend organizations: * Implement MFA and single sign-on (SSO) wherever possible -- preferably Fast Identity Online (FIDO). In the cases we investigated, Muddled Libra was most successful when they convinced employees to help them bypass MFA. When they could not quickly establish a foothold, they appeared to move on to other targets. * Defenders should consider implementing security alerting and account lockout on repeated MFA failures. * Implement comprehensive user awareness training. Muddled Libra is heavily focused on social engineering help desk and other employees via phone and SMS. Employee training on identifying suspicious non-email-based outreach is critical. * In case of a breach, assume this threat actor knows the modern IR playbook. Consider setting up out-of-band response mechanisms. * Ensure credential hygiene is up to date. Only grant access when and for as long as necessary. * Monitoring and managing access to critical defenses and controls is essential to defending against skilled attackers. Rights should be restricted to only what is necessary for each job function. Identity threat detection and response (ITDR) tools such as [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [Cortex XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) should be used to monitor for abnormal behavior. * Defenders should limit anonymization services allowed to connect to the network, ideally at the firewall by [App-ID](https://www.paloaltonetworks.com/technologies/app-id). To defend against the threats described in this blog, Palo Alto Networks further recommends that organizations employ the following capabilities: * Network security: delivered through a Next-Generation Firewall (NGFW) configured with machine learning enabled and best-in-class, cloud-delivered security services. This includes, for example, threat prevention, URL filtering, DNS security and a malware prevention engine capable of identifying and blocking malicious samples and infrastructure. * Endpoint security: delivered through an XDR solution that can identify malicious code through advanced machine learning and behavioral analytics. This solution should be configured to act on and block threats in real-time as they are identified. * Security automation: delivered through an XSOAR or XSIAM solution capable of providing SOC analysts with a comprehensive understanding of the threat derived by stitching together data from endpoints, network, cloud and identity systems. If you think you might have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America Toll-Free: 866.486.4842 (866.4.UNIT42) * EMEA: +31.20.299.3130 * APAC: +65.6983.8730 * Japan: +81.50.1790.0200 ## Indicators of Compromise IPs observed during this activity: * 104\.247.82\[.\]11 * 105\.101.56\[.\]49 * 105\.158.12\[.\]236 * 134\.209.48\[.\]68 * 137\.220.61\[.\]53 * 138\.68.27\[.\]0 * 146\.190.44\[.\]66 * 149\.28.125\[.\]96 * 157\.245.4\[.\]113 * 159\.223.208\[.\]47 * 159\.223.238\[.\]0 * 162\.19.135\[.\]215 * 164\.92.234\[.\]104 * 165\.22.201\[.\]77 * 167\.99.221\[.\]10 * 172\.96.11\[.\]245 * 185\.56.80\[.\]28 * 188\.166.92\[.\]55 * 193\.149.129\[.\]177 * 207\.148.0\[.\]54 * 213\.226.123\[.\]104 * 35\.175.153\[.\]217 * 45\.156.85\[.\]140 * 45\.32.221\[.\]250 * 64\.227.30\[.\]114 * 79\.137.196\[.\]160 * 92\.99.114\[.\]231 ## Additional Resources * [Muddled Libra Discussion With Unit 42 Senior Consultant Stephanie Regan](https://playlist.megaphone.fm/?e=CYBW2420634274&start=855&utm_content=261841717&utm_medium=social&utm_source=linkedinpanw_channel=lcp-10454826?utm_source=linkedin-unit42-global&utm_medium=social) -- Threat Vector Podcast, Unit 42 on CyberWire Daily * [Exposing Muddled Libra's Meticulous Tactics With Unit 42 Senior Researcher Kristopher Russo](https://www.youtube.com/watch?v=Znq1fgMSFJs&list=PLaKGTLgARHpO1zjPmTlWuYsYEKR0SKUPa&index=30) -- Threat Vector Podcast, Unit 42 on CyberWire Daily * [Muddled Libra's Evolution to the Cloud](https://unit42.paloaltonetworks.com/muddled-libra-evolution-to-cloud/) -- Unit 42, Palo Alto Networks * [Roasting 0ktapus: The phishing campaign going after Okta identity credentials](https://www.group-ib.com/blog/0ktapus/) -- Group-IB * [Not a SIMulation: CrowdStrike Investigations Reveal Intrusion Campaign Targeting Telco and BPO Companies](https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/) -- CrowdStrike * [Detecting Scatter Swine: Insights into a Relentless Phishing Campaign](https://sec.okta.com/scatterswine) -- Okta * [I Solemnly Swear My Driver Is Up to No Good: Hunting for Attestation Signed Malware](https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware) -- Mandiant * [Is Your Browser Extension a Botnet Backdoor?](https://krebsonsecurity.com/2021/03/is-your-browser-extension-a-botnet-backdoor/) -- Krebs on Security * [Suspicion stalks Genesis Market's competitors following FBI takedown](https://therecord.media/genesis-market-russian-market-2easy-shop-cybercrime-fraud) -- The Record, Recorded Future News *Updated May 16, at 10:12 a.m. PT to include the evolution of Muddled Libra activity since the beginning for 2024.* Back to top ### Tags * [0ktapus](https://unit42.paloaltonetworks.com/tag/0ktapus/ "0ktapus") * [ALPHV](https://unit42.paloaltonetworks.com/tag/alphv/ "ALPHV") * [App-ID](https://unit42.paloaltonetworks.com/tag/app-id/ "app-ID") * [BlackCat ransomware](https://unit42.paloaltonetworks.com/tag/blackcat-ransomware/ "BlackCat ransomware") * [MITRE](https://unit42.paloaltonetworks.com/tag/mitre/ "MITRE") * [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra") * [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing") * [Scatter Swine](https://unit42.paloaltonetworks.com/tag/scatter-swine/ "Scatter Swine") * [Scattered Spider](https://unit42.paloaltonetworks.com/tag/scattered-spider/ "Scattered Spider") * [Social engineering](https://unit42.paloaltonetworks.com/tag/social-engineering/ "social engineering") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: DarkCloud Stealer: Comprehensive Analysis of a New Attack Chain That Employs AutoIt](https://unit42.paloaltonetworks.com/darkcloud-stealer-and-obfuscated-autoit-scripting/ "DarkCloud Stealer: Comprehensive Analysis of a New Attack Chain That Employs AutoIt") ### Table of Contents * ### Related Articles * [Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "article - table of contents") * [Inside the Modern SOC: The Identity Front Door](https://unit42.paloaltonetworks.com/soc-identity-front-door/ "article - table of contents") * [Russian Global Webmail Espionage](https://unit42.paloaltonetworks.com/russian-webmail-espionage/ "article - table of contents") ## Related Malware Resources ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)