AsyncRAT Espionage Campaign Targeting Libyan Oil Infrastructure
AsyncRAT Espionage Campaign Targeting Libyan Oil (TL-2026-0254), also tracked as AsyncRAT Libya Campaign, is a high-severity advanced persistent threat campaign, first published 2026-03-20. It has no confirmed attribution, affects Libyan Oil Refinery Industrial Control Systems / IT Infrastructure, references 2 CVEs (CVE-2023-6895, CVE-2017-7921), maps to 23 MITRE ATT&CK techniques (T1036, T1041, T1053), and is covered by 9 detection rules and 41 indicators of compromise.
Key facts for TL-2026-0254
- Threat ID
- TL-2026-0254
- Also known as
- AsyncRAT Libya Campaign, Libya Oil Infrastructure Campaign
- Severity
- HIGH
- Status
- MONITORING
- Category
- APT
- First published
- 2026-03-20
- Last reviewed
- 2026-03-20
- Attribution confidence
- NONE
- Motivation
- ESPIONAGE
- Target sectors
- energy, oil-and-gas, critical-infrastructure, telecommunications, government
- Target regions
- Libya, North Africa, Middle East
- Detection rules
- 9
- Indicators of compromise
- 41
Malware and tooling in AsyncRAT Espionage Campaign Targeting Libyan Oil
Malware and tooling: AsyncRAT
Long-running likely state-sponsored espionage campaign deploying AsyncRAT backdoor against Libyan oil refinery, telecommunications, and state institution targets. Attack chain uses Libya-themed spear-phishing lures referencing the Saif al-Gaddafi assassination, VBS downloaders, PowerShell droppers hosted on Kraken Files, and scheduled task persistence. Active from November 2025 through February 2026 with peak activity mid-February 2026.
How AsyncRAT Espionage Campaign Targeting Libyan Oil works
A sustained espionage campaign has been targeting Libyan critical infrastructure since at least November 2025, deploying the AsyncRAT remote access trojan through a multi-stage infection chain. The campaign specifically targets a Libyan oil refinery, a telecommunications organization, and a state institution.
The attack begins with spear-phishing emails containing Libya-themed lure documents designed to exploit current geopolitical events. The primary lure references leaked CCTV footage of Saif al-Gaddafi's assassination on February 3, 2026, delivered as a compressed archive ('Leaked CCTV footage - Saif al-Gaddafi assassination.gz'). Additional lures reference Libyan political figures including Haftar and Dbeibeh, and geopolitical tensions involving Russia, Egypt, Algeria, Jordan, and Israel.
The infection chain proceeds through multiple stages: (1) The victim opens a VBS downloader script with a topical filename such as 'video_saif_gadafi_2026.vbs'. (2) The VBS script downloads a PowerShell dropper disguised as an image file ('image.png') from Kraken Files cloud storage at 'hs8.krakenfiles.com/uploads/15-02-2026/JCaF7rrPQm/image.png'. (3) The PowerShell dropper creates a scheduled task named 'devil' using an XML configuration file stored at 'C:\Users\Public\Music\Googless.xml'. (4) The scheduled task executes via schtasks.exe, deploying the final AsyncRAT payload. (5) The scheduled task is immediately deleted after execution to minimize forensic footprint.
AsyncRAT is a modular, open-source remote access trojan first published on GitHub in January 2019. Its capabilities include keylogging via Windows API SetWindowsHookEx, screen capture, remote desktop control, webcam access, audio recording, file management, password recovery, remote shell execution, and payload injection. The modular architecture allows operators to customize and extend functionality.
The campaign shows indicators of state-sponsored activity based on the targeting of critical infrastructure, the sustained operational tempo across multiple months, and the sophisticated use of current geopolitical events as social engineering vectors. However, specific threat actor attribution remains unconfirmed. The public availability of AsyncRAT prevents definitive attribution based on tooling alone.
The CVEs referenced in associated intelligence (CVE-2023-6895 and CVE-2017-7921) relate to Hikvision surveillance camera vulnerabilities. CVE-2017-7921 is an improper authentication vulnerability (CVSS 9.8) in Hikvision cameras allowing full administrative bypass, added to CISA KEV with remediation deadline of March 26, 2026. CVE-2023-6895 is a critical OS command injection vulnerability in Hikvision Intercom Broadcasting System. These vulnerabilities are contextually relevant given the CCTV-themed lure documents and targeting of physical security infrastructure at oil facilities.
This campaign shares operational overlap with the Desert Dexter campaign, a separate AsyncRAT operation active since September 2024 that targeted approximately 900 victims across the MENA region with 49% of victims located in Libya, using politically charged social media content and modified AsyncRAT variants with cryptocurrency wallet stealing capabilities.
MITRE ATT&CK techniques used in TL-2026-0254
defense-evasion
T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution
collection
T1056 Input Capture; T1113 Screen Capture; T1123 Audio Capture; T1125 Video Capture
discovery
T1057 Process Discovery; T1082 System Information Discovery
command-and-control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1573 Encrypted Channel
persistence
T1547 Boot or Logon Autostart Execution
credential-access
T1555 Credentials from Password Stores
impact
initial-access
Affected products and versions in AsyncRAT Espionage Campaign Targeting Libyan Oil
- Libyan Oil Refinery — Industrial Control Systems / IT Infrastructure
Vulnerable versions: All - Libyan Telecommunications Organization — Network Infrastructure
Vulnerable versions: All - Libyan State Institution — Government IT Systems
Vulnerable versions: All - Microsoft — Windows
Vulnerable versions: Windows 10; Windows 11; Windows Server 2016; Windows Server 2019; Windows Server 2022 - Hikvision — IP Cameras
Vulnerable versions: Multiple models pre-patch
Fixed in: Firmware updates per CVE-2017-7921 advisory - Hikvision — Intercom Broadcasting System
Vulnerable versions: 3.0.3_20201113_RELEASE
Fixed in: 4.1.0+
Remediation for AsyncRAT Espionage Campaign Targeting Libyan Oil
Patches
- Apply Hikvision firmware updates to address CVE-2017-7921 (improper authentication)
- Upgrade Hikvision Intercom Broadcasting System to v4.1.0+ for CVE-2023-6895
- Ensure all Windows systems have current AV signatures for AsyncRAT variants
Immediate actions
- Block all known IOC hashes at endpoint protection layer
- Block krakenfiles.com at web proxy and DNS filtering
- Hunt for scheduled tasks named 'devil' across all endpoints
- Search for Googless.xml in C:\Users\Public\Music\ on all systems
- Monitor for schtasks.exe creating tasks from XML files in non-standard directories
- Block VBS execution via Windows Script Host where not business-required
- Quarantine and investigate any systems with AsyncRAT indicators
Workarounds
- Disable Windows Script Host (wscript.exe/cscript.exe) via Group Policy where feasible
- Restrict PowerShell execution policy to AllSigned or RemoteSigned
- Block outbound connections to file-sharing platforms from critical infrastructure networks
- Implement scheduled task creation alerting via SIEM
Longer-term hardening
- Deploy EDR with behavioral detection for multi-stage script-based attacks
- Implement application whitelisting to prevent unauthorized VBS and PowerShell execution
- Enable PowerShell script block logging and module logging
- Deploy email security gateway with sandboxing for compressed archive attachments
- Implement network segmentation between IT and OT environments at oil facilities
- Conduct security awareness training focused on geopolitical social engineering lures
- Audit and patch all Hikvision surveillance cameras per CVE-2017-7921 and CVE-2023-6895
- Monitor for AsyncRAT C2 traffic patterns including encrypted callback channels
CVEs associated with AsyncRAT Espionage Campaign Targeting Libyan Oil
Weaknesses (CWE) in AsyncRAT Espionage Campaign Targeting Libyan Oil
CWE-287, CWE-78
Timeline of AsyncRAT Espionage Campaign Targeting Libyan Oil
- AsyncRAT open-source remote access trojan published on GitHub
- Desert Dexter campaign begins targeting MENA region with modified AsyncRAT variant via Facebook ads and Telegram
- Earliest potential campaign indicators detected on VirusTotal based on file submission timestamps
- Additional VBS downloader samples with Libya-themed filenames observed in earlier activity window
- Earliest confirmed malicious activity on Libyan oil refinery networks and related critical infrastructure targets
- Sustained campaign activity observed on oil company networks with additional VBS downloader variants deployed
- Saif al-Gaddafi assassination occurs, immediately leveraged as social engineering lure theme for spear-phishing
- Peak campaign activity observed with PowerShell dropper hosted on Kraken Files timestamped February 15, 2026
- CISA adds CVE-2017-7921 (Hikvision improper authentication) to KEV catalog with remediation deadline March 26, 2026
- Broadcom/Symantec publishes detailed threat intelligence report on campaign targeting Libyan oil infrastructure
- As of 2026-05-29, the discrete Libyan oil-infrastructure AsyncRAT campaign shows no public activity past mid-Feb 2026 (only retrospective Symantec disclosure on Mar 20), so its observed active phase has lapsed. The actor stays unattributed (not disrupted) and the underlying AsyncRAT tooling plus KEV-listed CVE-2017-7921 remain actively exploited, warranting continued monitoring rather than closure.
Sources cited for AsyncRAT Espionage Campaign Targeting Libyan Oil
- Libyan Oil Refinery Among Targets in Long-running Likely Espionage Campaign
- Desert Dexter - Attacks on Middle Eastern Countries
- Desert Dexter Targets 900 Victims Using Facebook Ads and Telegram Malware Links
- AsyncRAT C2 Framework - Overview Technical Analysis and Detection
- NVD - CVE-2023-6895 Hikvision Intercom OS Command Injection
- CVE-2017-7921 Hikvision Improper Authentication
- CISA KEV - Hikvision CVE-2017-7921 Added
- Emulating the Open-Source Remote Access Trojan AsyncRAT
- Analyzing a Multi-Stage AsyncRAT Campaign via MDR
- AsyncRAT Malware - Analysis Detection Removal
- Advisory Alert - AsyncRAT Analysis Evolution and Defense Strategies
- Trojan VBS AsyncRAT - Microsoft Security Intelligence
Threats related to AsyncRAT Espionage Campaign Targeting Libyan Oil
Detection coverage for TL-2026-0254
As of 2026-03-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0254 across Splunk SPL, Microsoft KQL and Sigma, covering 41 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.