Loading story…
A likely state-backed cyberespionage campaign targeted Libyan organizations including an oil refinery, an oil company network, a telecommunications entity, and a state institution, using politically themed spear-phishing emails to deliver the AsyncRAT remote access trojan. Researchers said the operation ran from November 2025 to mid-February 2026, with related files suggesting activity may have begun as early as April 2025. The lures referenced Libya-specific political events, including reports about the killing of Saif al-Islam Gaddafi, indicating deliberate targeting tied to local developments.
The intrusion chain used a VBS downloader, a PowerShell dropper, and persistence through a scheduled task named devil before deploying AsyncRAT, which can enable keystroke logging, screen capture, credential theft, and remote command execution. Investigators said the victimology, duration, and tradecraft point to espionage rather than financially motivated crime, and noted overlaps with prior Middle East activity linked to Iran-associated MuddyWater, though no definitive attribution was made.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
On publication of the reports, researchers publicly detailed the likely espionage campaign, its Libya-themed lures, victim sectors, and technical overlap with prior Middle East activity associated with MuddyWater. They assessed the operation as likely state-sponsored but did not make a definitive attribution.
Researchers said the campaign against at least one Libyan oil-sector target continued until mid-February 2026, suggesting a multi-month compromise. The intrusion used VBS and PowerShell components plus a scheduled task for persistence before deploying AsyncRAT.
Between November 2025 and February 2026, attackers targeted Libyan organizations including an oil refinery, an oil company network, a telecommunications organization, and a state institution. The campaign used politically themed spear-phishing emails and a multi-stage infection chain to deploy the AsyncRAT remote access Trojan.
Researchers found related files on VirusTotal dating back to April 2025, indicating the broader operation targeting Libyan entities may have started earlier than the main observed intrusion window. The activity appeared focused on Libyan targets from an early stage.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurity.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research reported a targeted espionage campaign in North Africa, primarily against Libyan organizations, using a previously undocumented modular Windows backdoor dubbed **Stealth Soldier**. The malware was built for surveillance and theft, with capabilities including file exfiltration, screenshot capture, microphone recording, keystroke logging, browser credential theft, and PowerShell-based command execution. Researchers observed several versions of the malware, from Version 6 compiled in October 2022 through Version 9 likely delivered in February 2023, indicating the operation remained under active development. The intrusion chain used a downloader, loader, watchdog, and final payload, while command-and-control and delivery infrastructure included domains such as `filestoragehub[.]live`, `customjvupdate[.]live`, and `filecloud[.]store`. Check Point said the infrastructure and phishing-domain naming patterns overlap with the earlier **Eye on the Nile** activity, suggesting the return of the same threat actor or a closely related cluster. The broader infrastructure also included phishing domains impersonating the Libyan Ministry of Foreign Affairs and webmail or login portals, aligning the campaign with politically motivated surveillance activity seen in prior phishing operations against civil society targets in the region, including Egyptian organizations documented by Amnesty International.
Aug 14, 2026
Security researchers documented multiple Iran-linked intrusion campaigns that used spearphishing and staged malware delivery to target governments, industrial organizations, and Syrian opposition figures. Palo Alto Networks traced the **Infy** malware family to a long-running espionage operation active from 2007 through at least 2016, using malicious Word and PowerPoint files to install keyloggers, steal browser credentials, collect documents, and exfiltrate data from victims including government-related entities in Israel, the United States, and Denmark. Citizen Lab separately described **Group5**, an Iran-nexus operation that targeted Syrian opposition members with politically themed phishing emails and a watering-hole site, exploiting `CVE-2014-4114` to deliver **NanoCore**, **njRAT**, and an Android **DroidJack** implant. The campaigns combined custom tooling, commodity remote-access trojans, and operational infrastructure that pointed back to Iran. In the Group5 case, researchers tied the activity to an Iranian hosting provider, observed operator access from Iranian IP space, and found Persian-language development artifacts and crypter links, while the Infy operation was connected through shared infrastructure, malware strings, and a distinctive encoding scheme across more than 40 variants, including the more capable **Infy M** branch. Together, the reports show sustained espionage activity built on low-volume, highly targeted phishing, multi-stage malware chains, and surveillance-focused payloads aimed at credential theft, device monitoring, and data exfiltration.
Aug 15, 2026
Iran-linked threat group **OilRig** (also tracked as **APT34**, **Crambus**, and in some reporting linked with **Lyceum/Hexane**) has conducted a long-running cyberespionage campaign against government, diplomatic, technology, medical, energy, and utility targets across the Middle East and nearby regions. Researchers tied the group to spear-phishing operations that used compromised business email accounts, fake **University of Oxford** conference and job sites, trojanized VPN installers, and malicious Office documents to deliver malware including **Helminth**, **ALMA Communicator**, **Marlin**, and other custom backdoors. In one notable case, malware was digitally signed with a legitimate **AI Squared** code-signing certificate, making the payloads appear trustworthy and highlighting either certificate theft or compromise. The intrusions evolved into deeper post-compromise operations featuring credential theft, webshell deployment, lateral movement, and covert command-and-control. Reports described OilRig-linked operators using **Mimikatz**, **PsExec**, **Plink**, scheduled tasks, SSH tunnels, spoofed webmail portals, and IIS backdoors such as **RGDoor**, while newer tradecraft included **DNS tunneling**, **OneDrive API** communications, and the **PowerExchange** technique that abused a compromised Exchange mailbox for C2. A later campaign against a Middle Eastern government reportedly compromised at least 12 systems, stole files and passwords, enabled remote RDP access, and deployed malware families including **Backdoor.Tokel**, **Trojan.Dirps**, and **Infostealer.Clipog**, underscoring that OilRig remains an active and adaptable Iranian espionage threat.
Aug 15, 2026