# AsyncRAT Espionage Campaign Targeting Libyan Oil Infrastructure

> Long-running likely state-sponsored espionage campaign deploying AsyncRAT backdoor against Libyan oil refinery, telecommunications, and state institution targets. Attack chain uses Libya-themed spear-phishing lures referencing the Saif al-Gaddafi assassination, VBS downloaders, PowerShell droppers hosted on Kraken Files, and scheduled task persistence. Active from November 2025 through February 2026 with peak activity mid-February 2026.

- **Published:** 2026-03-20T12:00:00Z
- **Last reviewed:** 2026-03-20T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0254
- **ID:** TL-2026-0254
- **Severity:** HIGH
- **Category:** APT
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 41 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-6895, CVE-2017-7921

## Description

A sustained espionage campaign has been targeting Libyan critical infrastructure since at least November 2025, deploying the AsyncRAT remote access trojan through a multi-stage infection chain. The campaign specifically targets a Libyan oil refinery, a telecommunications organization, and a state institution.

The attack begins with spear-phishing emails containing Libya-themed lure documents designed to exploit current geopolitical events. The primary lure references leaked CCTV footage of Saif al-Gaddafi's assassination on February 3, 2026, delivered as a compressed archive ('Leaked CCTV footage - Saif al-Gaddafi assassination.gz'). Additional lures reference Libyan political figures including Haftar and Dbeibeh, and geopolitical tensions involving Russia, Egypt, Algeria, Jordan, and Israel.

The infection chain proceeds through multiple stages: (1) The victim opens a VBS downloader script with a topical filename such as 'video_saif_gadafi_2026.vbs'. (2) The VBS script downloads a PowerShell dropper disguised as an image file ('image.png') from Kraken Files cloud storage at 'hs8.krakenfiles.com/uploads/15-02-2026/JCaF7rrPQm/image.png'. (3) The PowerShell dropper creates a scheduled task named 'devil' using an XML configuration file stored at 'C:\Users\Public\Music\Googless.xml'. (4) The scheduled task executes via schtasks.exe, deploying the final AsyncRAT payload. (5) The scheduled task is immediately deleted after execution to minimize forensic footprint.

AsyncRAT is a modular, open-source remote access trojan first published on GitHub in January 2019. Its capabilities include keylogging via Windows API SetWindowsHookEx, screen capture, remote desktop control, webcam access, audio recording, file management, password recovery, remote shell execution, and payload injection. The modular architecture allows operators to customize and extend functionality.

The campaign shows indicators of state-sponsored activity based on the targeting of critical infrastructure, the sustained operational tempo across multiple months, and the sophisticated use of current geopolitical events as social engineering vectors. However, specific threat actor attribution remains unconfirmed. The public availability of AsyncRAT prevents definitive attribution based on tooling alone.

The CVEs referenced in associated intelligence (CVE-2023-6895 and CVE-2017-7921) relate to Hikvision surveillance camera vulnerabilities. CVE-2017-7921 is an improper authentication vulnerability (CVSS 9.8) in Hikvision cameras allowing full administrative bypass, added to CISA KEV with remediation deadline of March 26, 2026. CVE-2023-6895 is a critical OS command injection vulnerability in Hikvision Intercom Broadcasting System. These vulnerabilities are contextually relevant given the CCTV-themed lure documents and targeting of physical security infrastructure at oil facilities.

This campaign shares operational overlap with the Desert Dexter campaign, a separate AsyncRAT operation active since September 2024 that targeted approximately 900 victims across the MENA region with 49% of victims located in Libya, using politically charged social media content and modified AsyncRAT variants with cryptocurrency wallet stealing capabilities.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1106 Native API
- T1547 Boot or Logon Autostart Execution
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1070 Indicator Removal
- T1497 Virtualization/Sandbox Evasion
- T1056 Input Capture
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1057 Process Discovery
- T1113 Screen Capture
- T1123 Audio Capture
- T1125 Video Capture
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1571 Non-Standard Port
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1565 Data Manipulation

## Sources

- [Libyan Oil Refinery Among Targets in Long-running Likely Espionage Campaign](https://www.security.com/threat-intelligence/asyncrat-libya-oil-cyberattack)
- [Desert Dexter - Attacks on Middle Eastern Countries](https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/desert-dexter-attacks-on-middle-eastern-countries/)
- [Desert Dexter Targets 900 Victims Using Facebook Ads and Telegram Malware Links](https://thehackernews.com/2025/03/desert-dexter-targets-900-victims-using.html)
- [AsyncRAT C2 Framework - Overview Technical Analysis and Detection](https://blog.qualys.com/vulnerabilities-threat-research/2022/08/16/asyncrat-c2-framework-overview-technical-analysis-and-detection)
- [NVD - CVE-2023-6895 Hikvision Intercom OS Command Injection](https://nvd.nist.gov/vuln/detail/CVE-2023-6895)
- [CVE-2017-7921 Hikvision Improper Authentication](https://wnesecurity.com/cve-2017-7921/)
- [CISA KEV - Hikvision CVE-2017-7921 Added](https://vulert.com/blog/hikvision-rockwell-cve-2017-7921-cve-2021-22681/)
- [Emulating the Open-Source Remote Access Trojan AsyncRAT](https://www.attackiq.com/2024/05/24/emulating-asyncrat/)
- [Analyzing a Multi-Stage AsyncRAT Campaign via MDR](https://www.trendmicro.com/en_us/research/26/a/analyzing-a-a-multi-stage-asyncrat-campaign-via-mdr.html)
- [AsyncRAT Malware - Analysis Detection Removal](https://www.huntress.com/threat-library/malware/asyncrat)
- [Advisory Alert - AsyncRAT Analysis Evolution and Defense Strategies](https://lumu.io/blog/asyncrat-2026-analysis-evolution-defense/)
- [Trojan VBS AsyncRAT - Microsoft Security Intelligence](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:VBS/AsyncRAT)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0254