Trojan Horse in the Server Room: Muddled Libra’s Rogue VM Strategy Exposed

Unit 42 details how Muddled Libra (Scattered Spider/UNC3944) used social engineering against support staff to gain access to a victim's VMware vSphere, spin up a rogue VM as an operational base, and then rely on standard administrative utilities and living‑off‑the‑land techniques to map the network, establish C2 and persistence, and exfiltrate data (including interactions with Snowflake); the report emphasizes that the group's effectiveness stems from exploiting human trust and weak access controls and recommends defense‑in‑depth, identity protection, least‑privileged access, and detection of living‑off‑the‑land behaviors.