The global security-focused website SECURITYM reported on Thursday that Libya experienced a series of cyberattacks targeting a Libyan oil refinery, a telecommunications company, and a government institution between November 2025 and February 2026.
According to the report, these attacks involved the use of the spyware tool AsyncRAT, a publicly available program that has previously been used by both state-sponsored actors and other threat groups. This suggests the possibility that the activity may have been state-backed.
The website noted that although this activity predates the escalation caused by U.S. and Israeli strikes on Iran—which contributed to tensions in the Gulf region and disruptions in global oil markets—the targeting of an oil refinery is particularly significant. Libya’s oil production reached 1.37 million barrels per day last year, its highest level in nearly 12 years. Amid ongoing instability in the Middle East, attacks on oil producers in other countries may increase as concerns over global energy supplies grow.
Attack chain:
The report added that targeted email campaigns were likely the primary attack vector in this operation. Investigators found deceptive files on compromised networks designed to exploit interest in Libyan affairs. One such file was titled “Leaked Surveillance Camera Footage,” according to the report.
