Returned Libra
No sourced public emblem in this profile.
reference profile · reported nexus: Unknown (not nationality)
Returned Libra, also known as 8220 Mining Group, is a cloud threat actor group that has been active since at least 2017. Tools commonly employed during their operations are PwnRig or DBUsed which are customized variants of the XMRig Monero mining software. The Returned Libra mining group is believed to have originated from a GitHub fork of the Rocke group's software. Returned Libra has elevated its mining operations with the use of cloud service platform credential scrapping.
Source-reported aliases: 8220 Mining Group. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://unit42.paloaltonetworks.com/atoms/returnedlibra/