THREAT GROUP ASSESSMENT: MUDDLED LIBRA (UPDATED MAY 16, 2025)

Summary from the TLDR InfoSec newsletter

Muddled Libra, a threat group specializing in social engineering attacks using the 0ktapus phishing kit, targets organizations in software automation, BPO, telecommunications, and technology, particularly large outsourcing firms for high-value cryptocurrency institutions. The group shows deep knowledge of enterprise IT systems and utilizes a comprehensive toolkit, including smishing, MFA bombing, help desk social engineering, and commercial remote monitoring tools to maintain access and evade detection. Its main goal is data theft for supply chain attacks, leveraging stolen information from initial victims to infiltrate downstream customer environments.