Libyan Oil Refinery Hit in Long-Running Espionage Campaign Using AsyncRAT

A coordinated espionage campaign from Nov 2025–Feb 2026 targeted Libyan critical infrastructure (an oil refinery, a telecom, and a state institution) using politically themed spear-phishing lures and a multi-stage infection chain (VBS downloader named like "video_saif_gadafi_2026.vbs" → PowerShell dropper disguised as "image.png" → scheduled task "devil" with XML persistence) to deploy AsyncRAT, enabling sustained remote access, keystroke logging, and screen capture; investigators observed months-long persistence and recommend hardening against scripted droppers, monitoring for unusual scheduled tasks, and deploying behavior-based detection for RAT activity.