APT / THREAT GROUP
Watchdog
2
aliases
Last seen:Mar 17, 2026
Intelligence Profile
Thief Libra is a cloud-focused threat group that has a history of cryptojacking operations as well as cloud service platform credential scraping. They were first known to operate on January 27, 2019. They use a variety of custom build Go Scripts as well as repurposed cryptojacking scripts from other groups including TeamTNT. They are currently considered to be an opportunistic threat group that targets exposed cloud instances and applications.
Threat Analysis
Watchdog is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.
Intelligence Reports Mentioning Watchdog
Russia appears to block social media platform Bluesky amid wider internet restrictions
The Record· Apr 14, 2026
Over 14,000 F5 BIG-IP APM instances still exposed to RCE attacks
BleepingComputer· Apr 2, 2026
Reddit Hit With $20 Million UK Data Privacy Fine Over Child Safety Failings
SecurityWeek· Feb 25, 2026
External References
Quick Facts
TypeAPT / Threat Group
Aliases2
SourceMalpedia
Also Known As
WatchdogThief Libra
Research Links
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.