WatchdogThreat actor
- thief libra
Thief Libra is a cloud-focused threat group that has a history of cryptojacking operations as well as cloud service platform credential scraping. They were first known to operate on January 27, 2019. They use a variety of custom build Go Scripts as well as repurposed cryptojacking scripts from other groups including TeamTNT.From MISP Galaxy
Last reported 5 days ago, by Security Affairs11 reports
ATT&CK techniques
6 of 30 · each with the sentence it comes from- T1684Social Engineering
“…cross all observed campaigns, the infection chains share a consistent packing technique, overlapping C2 infrastructure, and common social engineering patterns, linking them to a single operator.”
- T1027.009Embedded Payloads
“Its Stage 2 resembles Campaign 2 but differs by dropping multiple embedded payloads from the resource section, including PureRAT, a custom XMRig loader, and PureMiner.”
- T1053.005Scheduled Task
“Stage 3 is launched through PowerShell, and a scheduled task named SVCConfig is registered via schtasks.exe with an ONLOGON trigger and HIGHEST privilege.”
- T1055Process Injection
“…nt execution by the persistence mechanism, it verifies that it is running from its installation directory before proceeding to the process injection phase.”
- T1546.016Installer Packages
“The operator deploys a combination of RATs, cryptominers, and custom XMRig loaders through fake installer packages.”
- T1010Application Window Discovery
“Application Window Discovery”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
11 reports, newest first · the exact sentence from each-
Deepfakes and Election Manipulation: UK Watchdog Seeks Faster Detection“Deepfakes and Election Manipulation: UK Watchdog Seeks Faster Detection”
-
Major AI Firms Pledge Data Protection Changes Following UK Privacy Watchdog Push“Major AI Firms Pledge Data Protection Changes Following UK Privacy Watchdog Push”
-
Anthropic Flags AI Agent Liability Risks as OpenAI Faces Hacking Lawsuit“Related: Nvidia Unveils AI Agent Safety Platform With Hardware-Based Watchdog”
-
OpenAI Calls Off GPT-6.1 Astra Launch, Details Safety Cases for Frontier Training“Related: Nvidia Unveils AI Agent Safety Platform With Hardware-Based Watchdog”
-
Nvidia Unveils AI Agent Safety Platform With Hardware-Based Watchdog“Nvidia Unveils AI Agent Safety Platform With Hardware-Based Watchdog”
-
Watchdog finds most agencies failed to meet CISA cloud security orders, heightening risk of attack“Watchdog finds most agencies failed to meet CISA cloud security orders, heightening risk of attack”
-
Chinese espionage groups swarm to exploit triple-link chain of zero-days“Watchdog finds most agencies failed to meet CISA cloud security orders, heightening risk of attack”
-
TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook“Watchdog”
-
Untangling a Linux Incident With an OpenAI Twist (Part 2)“Watchdog script created by Actor B to scan for and kill competing miners roughly every”
-
Fake Installers to Monero: A Multi-Tool Mining Operation“Watchdog and Miner Processes”
-
Storm on the Horizon: Inside the AJCloud IoT Ecosystem“However, another cleaner option is to make use of the magic close feature of the Linux Kernel Watchdog Driver API.”
Indicators in its reports
named in the reports above- 62.60.246[.]210in 1 report
- hxxp://162.55.234[.]175:4082/workershin 1 report
- 162.55.234[.]175in 1 report
- pool.supportxmr[.]comin 1 report
- 147.45.41[.]25in 1 report
- 0x1x2x3[.]topin 1 report
- 57.129.119[.]218in 1 report
- 781c19b56fbdb172…5a50c4b0806cin 1 report
- 172.86.127[.]128in 1 report
- 172.245.159[.]216in 1 report
- protonmail[.]comin 1 report
- worker[.]devin 1 report
- hxxps://campanha1-api.ef971a42.workers[.]dev/api/installsin 1 report
Copy these 13 indicators · defanged
Thanks — we review every report.