Muddled Libra - PST Exfiltration via S3 Browser or Office Installer

nomit vyas@xoxo

•updated Jun 22, 2026•2•0•10

Detects the execution of S3 Browser or Office installation executables, followed by network traffic from the same host to known cloud storage or file-sharing sites within a short time window. This behavior aligns with Muddled Libra's method of staging and exfiltrating sensitive data, such as PST files, to adversary-controlled cloud buckets.