Rogue VM in VMware vSphere Linked to Muddled Libra Cyber Attack

Rogue VM in VMware vSphere Linked to Muddled Libra Cyber Attack

First seen 12 Feb 2026, 21:16 UTC •GbhackersCybersecuritynews •86% similarity •24.3

Article Content

Browse articles
ThreatCluster

In September 2025, a rogue virtual machine was discovered within a VMware vSphere environment, linked to the threat actor group Muddled Libra, also known as Scattered Spider and UNC3944. This VM served as a staging host for the intruders, allowing them to conduct reconnaissance and deploy tools within the network.

ThreatCluster AI How this analysis works

Timeline

2025-09-01
Rogue VM discovered in VMware vSphere environment
2025-09-01
Investigation linked VM to Muddled Libra
2026-02-12
Articles published detailing the attack and TTPs

Extracted Entities

1 / 2

Community

Browse all →

Tracked Entities in This Story

Muddled Libra Scattered Spider Unc3944 VMware vSphere