Libyan Oil Refinery Among Targets in Long-running Likely Espionage Campaign
Essential information
- Published
- 20/03/2026 21:15
- Modified
- 23/03/2026 09:58
- Tags
- 2026-03-20 asyncrat backdoor espionage oil refinery spear-phishing state-sponsored
- Related entities
- 29 observables, 12 techniques (mitre), 1 malware, 5 others
Description
A series of attacks targeting Libyan organizations, including an oil refinery, a telecoms organization, and a state institution, occurred between November 2025 and February 2026. The campaign utilized the AsyncRAT backdoor, delivered through spear-phishing emails with Libya-themed lure documents. The attackers exploited current events, such as the assassination of Saif al-Gaddafi, to gain access to networks. The modular nature of AsyncRAT and the targeted organizations suggest possible state sponsorship. The campaign's focus on Libya and its oil industry is notable, given the country's increased oil production and global energy supply concerns amidst Middle East conflicts.