Back Cybersecuritynews

Rogue VM Linked to Muddled Libra in VMware vSphere Attack, Revealing Key TTPs

Cybersecuritynews •Tushar Subhra Dutta • February 12, 2026

In a September 2025 incident response case, investigators found a rogue virtual machine inside a VMware vSphere environment and tied it with high confidence to Muddled Libra, also tracked as Scattered Spider and UNC3944. The VM acted like a quiet staging host, giving the intruders a place to recon the network, pull down tools, and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Rogue VM in VMware vSphere Linked to Muddled Libra Cyber Attack In September 2025, a rogue virtual machine was discovered within a VMware vSphere environment, linked to the threat actor group Muddled Libra, also known as Scattered Spider and UNC3944. This VM served as a staging host for the intruders, allowing them to conduct reconnaissance and deploy tools within the network. 2 sources 24

Extracted Entities

Rogue VM Linked to Muddled Libra in VMware vSphere Attack, Revealing Key TTPs

The full story

Extracted Entities

APT Groups (3)

Attack Types (1)

Platforms (1)