Libyan Refinery Targeted in Prolonged Spy Campaign With AsyncRAT

A sustained espionage campaign targeting Libyan critical infrastructure between November 2025 and February 2026 used spear‑phishing lures and VBS/PowerShell multi‑stage droppers to deliver the AsyncRAT backdoor, achieving persistent access to an oil company, a telecommunications provider, and a state institution; thematic lures, scheduled task persistence named "devil," and VirusTotal uploads provide IOCs, and while attribution is inconclusive the targeting and persistence suggest possible state‑aligned motives with implications for energy security.