Threat Group Assessment: Muddled Libra (Updated May 16, 2025)

Unit 42 details the 2025 evolution of Muddled Libra (Scattered Spider), a prolific cybercrime group that has shifted to rapid, voice-based social engineering (vishing) and partnerships with RaaS operators (e.g., DragonForce) to achieve swift domain compromise, large-scale data exfiltration, and extortion across government, retail, insurance, and aviation sectors; the report describes observed TTPs, case timelines, and recommended prevention, detection, and containment controls (notably Conditional Access Policies and hardened help-desk procedures).