Loading story…
ESET reported that a long-running malware operation dubbed Book of Eli targeted victims in Libya from at least 2012, using both mass-distribution and targeted intrusion tactics. The attackers spread the malware through compromised Facebook and Twitter accounts, spearphishing emails with executable attachments disguised as documents, and compromised Libyan government websites that served the payload to visitors.
The malware was described as an unobfuscated .NET information stealer capable of keylogging, stealing browser profile data, taking screenshots, recording audio, accessing webcams, and collecting host and antivirus details. Stolen data was primarily exfiltrated over SMTP to fixed email addresses, while some samples used HTTP command-and-control infrastructure including worldconnection[.]ly; ESET said the repeated use of the same destinations across samples indicated the campaign was likely run by a single actor or group despite the malware's relatively simple design.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
ESET published research detailing the long-running Book of Eli operation, its Libya-focused targeting, distribution through compromised social media and spearphishing, and its information-stealing capabilities. The report also described exfiltration via SMTP and HTTP and assessed the activity was likely run by a single actor or group.
The domain worldconnection[.]ly, later used by some Book of Eli samples to upload stolen data over HTTP, was registered in June 2016. ESET noted the associated server was located in Libya.
In 2013, operators used a Facebook lure written in Libyan Arabic that linked to malware hosted on a compromised Libyan governmental website. This was one of the observed mass-distribution methods for the campaign.
ESET said the malware operation it dubbed "Book of Eli" had been active since at least 2012 and was focused specifically on Libya. The campaign used both mass-spreading and targeted attack methods.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 45 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research reported a targeted espionage campaign in North Africa, primarily against Libyan organizations, using a previously undocumented modular Windows backdoor dubbed **Stealth Soldier**. The malware was built for surveillance and theft, with capabilities including file exfiltration, screenshot capture, microphone recording, keystroke logging, browser credential theft, and PowerShell-based command execution. Researchers observed several versions of the malware, from Version 6 compiled in October 2022 through Version 9 likely delivered in February 2023, indicating the operation remained under active development. The intrusion chain used a downloader, loader, watchdog, and final payload, while command-and-control and delivery infrastructure included domains such as `filestoragehub[.]live`, `customjvupdate[.]live`, and `filecloud[.]store`. Check Point said the infrastructure and phishing-domain naming patterns overlap with the earlier **Eye on the Nile** activity, suggesting the return of the same threat actor or a closely related cluster. The broader infrastructure also included phishing domains impersonating the Libyan Ministry of Foreign Affairs and webmail or login portals, aligning the campaign with politically motivated surveillance activity seen in prior phishing operations against civil society targets in the region, including Egyptian organizations documented by Amnesty International.
Aug 14, 2026
A likely state-backed cyberespionage campaign targeted Libyan organizations including an oil refinery, an oil company network, a telecommunications entity, and a state institution, using politically themed spear-phishing emails to deliver the `AsyncRAT` remote access trojan. Researchers said the operation ran from November 2025 to mid-February 2026, with related files suggesting activity may have begun as early as April 2025. The lures referenced Libya-specific political events, including reports about the killing of Saif al-Islam Gaddafi, indicating deliberate targeting tied to local developments. The intrusion chain used a VBS downloader, a PowerShell dropper, and persistence through a scheduled task named `devil` before deploying `AsyncRAT`, which can enable keystroke logging, screen capture, credential theft, and remote command execution. Investigators said the victimology, duration, and tradecraft point to espionage rather than financially motivated crime, and noted overlaps with prior Middle East activity linked to Iran-associated MuddyWater, though no definitive attribution was made.
Jun 29, 2026
Italian investigators tied the **EyePyramid** cyber-espionage operation to Giulio Occhionero and Francesca Maria Occhionero after uncovering a long-running spear-phishing campaign that compromised prominent figures across Italy’s political, financial, legal, academic, religious, and institutional sectors. Authorities reported more than 100 active victims on the malware server and indications that roughly 16,000 people may have been targeted over several years, with command-and-control evidence placing activity from at least 2014 to 2016 and possible malware development dating back to 2008. The operation reportedly stole tens of gigabytes of data by sending malicious attachments in low-sophistication phishing emails and harvesting files from infected systems. Technical analysis showed EyePyramid was a **.NET** implant protected with heavy obfuscation and anti-debugging and anti-virtual-machine checks, while maintaining persistence through `Run` and `RunOnce` registry keys. The malware attempted to weaken host defenses by altering firewall rules, changing folder permissions, disabling UAC, and interfering with security tools, then encrypted strings and exfiltrated data with **3DES** using host-dependent keys. Stolen data was sent mainly through **SMTP** and **IMAP** attachments, with additional **WebDAV** and **HTTP** support, and the implant could authenticate to command-and-control servers to download files while also containing code related to **Active Directory** and **LDAP** privilege operations.
Aug 15, 2026