Coordinated Cyber Espionage Targets Libyan Oil Sector

Between November 2025 and February 2026, a coordinated cyber espionage campaign targeted a Libyan oil refinery, a telecommunications organization, and a state institution. The attacks utilized AsyncRAT, a publicly available remote access Trojan known for its use by state-sponsored threat groups. This campaign specifically aimed at Libya's critical infrastructure, raising alarms about the security of the oil sector, which produced approximately 1.37 million barrels of oil per day in 2025. The scope of the attacks indicates a significant threat to national security and economic stability. As of March 23, 2026, the situation remains under investigation, with no confirmed attribution of the attackers.

Key Points: • A cyber espionage campaign targeted Libyan critical infrastructure from November 2025 to February 2026. • AsyncRAT was used in the attacks, indicating potential state-sponsored involvement. • The affected sectors include oil, telecommunications, and government institutions.