Cybercrime
Watchdog
Also known as Thief Libra
1mentions, 7 days
2mentions, 30 days
Oct 30, 2026last mentioned
Thief Libra is a cloud-focused threat group that has a history of cryptojacking operations as well as cloud service platform credential scraping. They were first known to operate on January 27, 2019. They use a variety of custom build Go Scripts as well as repurposed cryptojacking scripts from other groups including TeamTNT. They are currently considered to be an opportunistic threat group that targets exposed cloud instances and applications.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
- Watchdog Urges Police and Fire Service to Improve Cybersecurity https://www. infosecurity-magazine.com/news /watchdog-police-fire-service/mastodon · Oct 30, 2026
- Watchdog Warns Police and Fire Service Must Urgently Improve Cybersecu https://www. infosecurity-magazine.com/news /watchdog-police-fire-service/mastodon · Oct 27, 2026
References
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.