Unit 42 got their hands on a rogue virtual machine used by the Muddled Libra group, revealing an operational playbook that relies on social engineering and living-off-the-land techniques rather than sophisticated malware. The group used legitimate tools like Chisel, PsExec, and ADRecon to establish persistence, harvest credentials, enumerate Active Directory, and pull data from Snowflake and mailboxes, then struggled to find a file-sharing site the victim hadn’t already blocked. That fits Unit 42’s July 2025 threat assessment of the group (also tracked as Scattered Spider), which names help desk vishing as its main way in and describes a preference for the victim’s own tools over malware. CISA’s updated Scattered Spider advisory likewise warns that the actors go looking for Snowflake access to pull out large volumes of data quickly. When your entire attack chain is built from admin tools already on the network, EDR has a bad day.
