Threat Intel - Libyan Oil Refinery Targeted by AsyncRAT Attack

The Threat

Between November 2025 and February 2026, a coordinated espionage campaign targeted a Libyan oil refinery, a telecom organization, and a state institution. The attackers utilized AsyncRAT, a publicly available remote access Trojan known for its use by state-sponsored threat groups. This campaign raises significant concerns about the security of Libya's critical infrastructure, especially as the country’s energy sector plays a vital role in the global oil market.

The espionage campaign is believed to have been meticulously planned, with signs indicating that it may have begun as early as April 2025. Researchers from Symantec uncovered this operation through forensic analysis of compromised networks, revealing that the attackers had persistent access to the oil company's systems. This long-term infiltration suggests a clear intent for intelligence gathering.

Who's Behind It

The threat actor behind this campaign remains unidentified, but the use of AsyncRAT points to a sophisticated group likely motivated by geopolitical interests. The attackers employed spear-phishing tactics, using lure documents related to politically sensitive events in Libya to entice their targets. One notable lure document referenced the assassination of Saif al-Gaddafi, which occurred on February 3, 2026, highlighting the attackers' focus on current events to enhance their chances of success.

The targeted nature of these attacks indicates that the actors had a specific interest in Libya's energy sector, which has seen a resurgence in oil production. With the country producing 1.37 million barrels per day, the stakes are high, making it an attractive target for espionage.

Tactics & Techniques

The infection process began with a spear-phishing email that contained a locally themed lure document. Once the target engaged with the document, a VBS downloader was executed, which then downloaded a PowerShell dropper disguised as an innocent-looking image file. This dropper created a scheduled task that ensured its persistence on the system, allowing the attackers to maintain control without detection.

AsyncRAT was eventually delivered as the final payload, enabling the attackers to log keystrokes, capture screenshots, and execute commands remotely. This modular tool allows for updates and additional capabilities to be pushed without disrupting ongoing operations, making it particularly effective for long-term intelligence gathering.

Defensive Measures

Organizations in the energy sector and related fields must take immediate steps to bolster their defenses against similar attacks. Training staff to recognize spear-phishing attempts, especially those tied to current events, is crucial. Additionally, security teams should monitor for unusual scheduled task creations and restrict the execution of VBS and other scripting files from untrusted sources.

Implementing endpoint detection tools that can identify AsyncRAT's behavioral patterns, such as unauthorized keylogging and outbound command-and-control connections, is essential. By doing so, organizations can better protect themselves against the growing threat of state-sponsored espionage campaigns targeting critical infrastructure.