Returned Libra, also known as 8220 Mining Group, is a cloud threat actor group that has been active since at least 2017. Tools commonly employed durin...
Actor Overview
Related Threat Reports
PremiumAPT Campaign Analysis - Q4 2025Dec 2025
New Tactics Observed in WildDec 2025
Infrastructure Mapping ReportDec 2025
Stay Updated
Get alerts when new intel on Returned Libra is published.
Actor Details
Primary Name
Returned Libra
Known Aliases
8220 Mining Group
Data Source
Precursor Intelligence