Muddled Libra’s Evolution to the Cloud

## Executive Summary Unit 42 describes the evolution of the Muddled Libra threat actor toward targeting SaaS and cloud service provider (CSP) environments: attackers use help-desk social engineering to compromise identity portals (e.g., Okta), escalate privileges via identity provider abuse, discover credentials and sensitive data across SaaS (SharePoint, M365) and cloud services (AWS IAM, S3, Secrets Manager; Azure storage and resource groups), then leverage legitimate cloud features (AWS DataSync/AWS Transfer, Azure VM snapshots and newly created VMs) to stage and exfiltrate data; the report maps these activities to MITRE ATT&CK techniques and provides detection and mitigation guidance.