Multi-Month Cyberespionage Campaign Hit Libyan Oil Refinery

A suspected cyberespionage campaign targeted a Libyan oil refinery using commodity malware and politically themed phishing lures.

See Also: Securing Microsoft 365: A Live Breakdown of Modern Attack Paths

Threat researchers at Symantec and Carbon Black said the activity ran from November 2025 to mid-February, with evidence that attackers maintained long-term access to at least one oil company network. The intrusions involved the use of a widely available .NET-based remote access Trojan AsyncRAT.

Although the attacks occurred before the onset of the U.S. and Israeli bombing campaign against Iran, the two Broadcom-owned threat intel firms warned that “with so much disruption in the Middle East, it’s possible that attacks against oil producers in other countries could ramp up as fears grow about global energy supplies.” Libyan oil output reached a widely reported 12-year high in production of barrels per day in 2025.

The campaign began with spear-phishing emails carrying Libya-focused lure documents. One file referenced the killing of Saif al-Islam Gaddafi, a political figure assassinated in February. Researchers said the use of localized events as bait indicates deliberate target selection.

Opening the files triggers a multi-staged infection chain. A VBS downloader retrieves additional payloads from a cloud hosting service, followed by a PowerShell dropper that creates a scheduled task to maintain persistence before installing AsyncRAT.

AsyncRAT, originally released as an open-source GitHub project in 2019, has since been adopted by cybercriminals and state-linked groups for credential theft, surveillance and remote command execution, according to cybersecurity firm Check Point. AsyncRAT gives attackers a range of capabilities, including keystroke logging, screen capture and remote command execution.

Researchers identified multiple campaign-linked files, some dating back to April 2025, indicating the operation may have been active for months before the latest wave of attacks was detected.

Threat actors routinely exploit political instability and major events to craft convincing phishing lures and gain access to sensitive networks. Libya has faced prolonged instability since the fall of former Libyan leader Muammar Gaddafi in 2011.

The techniques overlap with activity seen in past Middle East espionage campaigns attributed to Iran-linked MuddyWater, which targeted government, telecom and energy organizations. One threat intel firm says group may be in a bombing-instigated lull, for now, although Symantec and Carbon Black have said they detected threat actor activity even after the onset of hostilities (see: Amazon Says Drone Strikes Disrupted Middle East Data Centers).