Back Gbhackers

Rogue VM Linked to Muddled Libra in VMware vSphere Attack, Exposing Critical TTPs

Gbhackers •Mayura Kathir • February 12, 2026

GBHackers on Security is a top cybersecurity news platform, delivering up-to-date coverage on breaches, emerging threats, malware, vulnerabilities, and global cyber incidents.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Rogue VM in VMware vSphere Linked to Muddled Libra Cyber Attack In September 2025, a rogue virtual machine was discovered within a VMware vSphere environment, linked to the threat actor group Muddled Libra, also known as Scattered Spider and UNC3944. This VM served as a staging host for the intruders, allowing them to conduct reconnaissance and deploy tools within the network. 2 sources 24

Extracted Entities

Rogue VM Linked to Muddled Libra in VMware vSphere Attack, Exposing Critical TTPs

The full story

Extracted Entities

APT Groups (1)

Attack Types (2)

Platforms (1)