Express Computer
Home  »  News  »  Muddled Libra poses great risk for BPO and Telecommunications industry: Palo Alto Networks Unit 42 Research

Muddled Libra poses great risk for BPO and Telecommunications industry: Palo Alto Networks Unit 42 Research

0 154

Unit 42, the threat intelligence and incident response team of global cybersecurity leader Palo Alto Networks, has released a blog with findings from its investigation into Muddled Libra – a high-risk threat group targeting BPO, software automation, and telecom companies. Across incidents investigated from mid-2022 to early-2023, the group sought and stole information on downstream client environments and used the same to pivot into those environments. It also demonstrated a strong understanding of its victims’ high-value clients and information most useful for follow-on attacks.

The attack style defining Muddled Libra was spotted in late-2022 with the release of the 0ktapus phishing kit. Through realistic fake authentication portals and targeted smishing, attackers quickly gathered credentials and multi-factor authentication (MFA) codes.

All threat actors that use 0ktapus are not Muddled Libra. Unit 42 has classified Muddled Libra with the following characteristics:

  • Using the 0ktapus phishing kit
  • Persistent targeting of the BPO industry
  • Long-term persistence
  • Nondestructive presence
  • Data theft
  • Use of compromised infrastructure in downstream attacks

“The BPO industry is one of the top employers in India, and securing them is paramount,” said Anil Valluri, MD & Regional VP for India & SAARC, Palo Alto Networks. “Muddled Libra demonstrates an unusually high degree of comfort engaging both the help desk and other employees by sending lure messages directly to their cellphones. These messages ask employees to update account information or re-authenticate a corporate application. Given the reliance on social engineering via phone and SMS, it is imperative to train employees to identify and flag such suspicious activities.”

Muddled Libra uses evasion tactics like disabling antivirus and host-based firewalls, deleting firewall profiles, creating defender exclusions, and deactivating or uninstalling EDR and other monitoring products. When unable to easily bypass robust multi factor authentication (MFA), Muddled Libra swiftly moved to other targets. Cybersecurity practitioners must consider how best to implement security alerting and account lockout on repeated MFA failures.

Get real time updates directly on you device, subscribe now.

Leave A Reply

Your email address will not be published.

LIVE Webinar

Digitize your HR practice with extensions to success factors

Join us for a virtual meeting on how organizations can use these extensions to not just provide a better experience to its’ employees, but also to significantly improve the efficiency of the HR processes
REGISTER NOW 
India's Leading e-Governance Summit is here!!! Attend and Know more.
Register Now!
close-image
Attend Webinar & Enhance Your Organisation's Digital Experience.
Register Now
close-image
Enable A Truly Seamless & Secure Workplace.
Register Now
close-image
Attend Inida's Largest BFSI Technology Conclave!
Register Now
close-image
Know how to protect your company in digital era.
Register Now
close-image
Protect Your Critical Assets From Well-Organized Hackers
Register Now
close-image
Find Solutions to Maintain Productivity
Register Now
close-image
Live Webinar : Improve customer experience with Voice Bots
Register Now
close-image
Live Event: Technology Day- Kerala, E- Governance Champions Awards
Register Now
close-image
Virtual Conference : Learn to Automate complex Business Processes
Register Now
close-image