Researchers Link AsyncRAT Campaign to Attacks on Libyan Organizations

Mar 20, 2026 · Original article ↗

Summary

Researchers report Libya-themed spear-phishing against a refinery, telecom provider and state institution, delivering AsyncRAT via VBS and PowerShell droppers. Samples suggest activity may date to April 2025; no actor attribution was established.

Key points

Researchers report activity against a Libyan oil refinery, a telecom provider and a state institution from November 2025 to mid-February 2026.
Likely spear-phishing used Libya-themed lures, including files referencing current affairs.
A VBS downloader fetched a PowerShell dropper from KrakenFiles; the dropper used a scheduled task named “devil” to install and run payloads.
The final payload was AsyncRAT, which can support keylogging, screen capture and remote command execution.
Related files on VirusTotal suggest the campaign may have begun as early as April 2025.
The researchers could not attribute the activity to a named actor; state sponsorship is presented as a possibility, not a finding.

Article Details

Attack Vectors: Likely spear-phishing using Libya-themed lure documents and VBS files.
A VBS downloader fetched a PowerShell dropper from a KrakenFiles URL; the dropper created and ran a scheduled task named "devil" and downloaded AsyncRAT.
Defensive Notes: The article advises organizations, particularly those in the energy sector, to be alert to phishing lures based on current events and geopolitical developments.
The article identifies the scheduled task named "devil" as a persistence artifact observed on compromised hosts.

Indicators of compromise

Type	Indicator	Context
SHA256	`0499152c6dd775491ce099eee4c382a94f72c07031081db164de921effa9664f`	Hash identified in the article as executing AsyncRAT.
SHA256	`0f3344e672d1ea6cde382b68b27063ed766fced717e9f5f2e15e6c79ce0737f7`	Hash identified in the article as an AsyncRAT sample.
SHA256	`12c65ac4e02313ed1aa2d32d56428f0a135b281604d536e5ae6ca08b6b4232c9`	Hash identified in the article as an AsyncRAT sample.
SHA256	`1d32f451d18c3dc8dbf00cd7df1200f83efa27cbaddeb9b2bed726e6d08ef5b1`	Listed among hashes of VBS downloaders associated with the campaign.
SHA256	`22a1cf91fbac104e2dd374dd06e93488cfdf216890088ef18318d90f440f00f6`	Listed among hashes of VBS downloaders associated with the campaign.
SHA256	`3101cc378db2665eb2969b62e28efb9bfd5ca6f9bd3ebc27b422d5a29bfd1b17`	Hash associated in the article's IOC list with the VBS downloader audio_libya.vbs.
SHA256	`34ae832427b03df5f8cb90e78b5b174665c19602575b37fc7cad8100978898d2`	Hash of the VBS downloader named list_name_libya.vbs.
SHA256	`39eade26c5680d20f5a8032a0d3996a29058e52c147e4b49a2072d2dcb353325`	Hash of the VBS downloader named video_saif_gadafi_2026.vbs.
SHA256	`3ca93362559db4da9d44d614345cbdfdb81d882367af05651bb718e1cc57ab08`	Listed among hashes of VBS downloaders associated with the campaign.
SHA256	`3d5ada3b035e2adc8de1db24ab9d8e0e828eec1b7601ed9d064b41fa9d026a34`	Hash of the VBS downloader named libya_russia_video2025.vbs.
SHA256	`43c5d9a267742ee3c6c9bcf3e6f63ec397fbe0233a5d99bdb7dacbfa1a0f69d5`	Hash of the VBS downloader named Audio_Libya_algeria.vbs.
SHA256	`5b573743306a2324608fdbd9c5cceba6bd5abfaccd1ea8b94c60f73da279e636`	Hash identified in the article as an AsyncRAT sample.
SHA256	`85e01e36b7b2b90af79642732a17dd566af0b10a85fd8a4cc85ea11583a0ff00`	Hash of the VBS downloader named video_saif_eslam.vbs.
SHA256	`946ae65e508acb4dbf6b29432889511a76636453cc04256230fbce25cef86b6a`	Hash identified in the article as an AsyncRAT sample.
SHA256	`9843874eb6217a79ba5a51a6a886745169b1a1ad43f7ae12de6e610324e88ab7`	Hash associated in the article's IOC list with the VBS downloader Libya_Jordan_File.vbs.
SHA256	`ad4e27fe06fae2325faa2a00be7b41f40aa9c63fe79713597b3330ad7e583ca8`	Hash of the VBS downloader named names_libya444.vbs.
SHA256	`ad796fc0ac17b58e47dbadd42bf164790c18ac67aade8c6bf2251056ef68138d`	Hash identified in the article as an AsyncRAT sample.
SHA256	`b4a3f2f5091df7174e82283ed59cd557eea2e8ddd7a018dafc5e8151fd683429`	Hash associated in the article's IOC list with the VBS downloader Libya_voice2025.vbs.
SHA256	`c03120163d9401d66d482899421d9dd68db63d34bac2b32e3090e8ad0b911d83`	Hash of VBS downloader samples, including audio_hafter_saif_eslam_rusia.vbs and list_names_libya.vbs.
SHA256	`c2a2c2b26b235bad31a352e1fd475794167ec79928c52d98bccb3607e932c7b2`	Hash of the VBS downloader named Voice_Egypt_hafter_Libya.vbs.
SHA256	`c3eef096073dd0873a821c35dd2e7eaf391863264ab72e1b91f2ca73218c2d04`	Hash of the dropper named image.png.
SHA256	`cd7e16ca636f6e5cb86cd41561d57620a131a26b53c6e25a36edcbbcb2b5276a`	Hash of the VBS downloader named voice_dbeibeh2025.vbs.
SHA256	`d884a17046bbefd73f76f88533e1f2da40d5233b15caa48245de65d2c19c50dc`	Hash of the PowerShell payload named payload_1.ps1.
SHA256	`eb76f0797c27821635992ef23a570fe3a11c848998bc9f7735e968adc6b2f33c`	Hash identified in the article as an AsyncRAT sample.
SHA256	`ece81cdc6fc12a07a984b98df58e34c92998cdd957e1f45cabd925056bb0f92e`	Hash identified in the article as an AsyncRAT sample.
SHA256	`f307f8fa89b9f9eb8c2ae346055dffb80c93f56034aa3abe7a8a25d6e5e680c6`	Hash identified in the article as an AsyncRAT sample.
SHA256	`f8b5a5429fb1da677ab8c09fc95b26e3b3d8bcd27521a56cc835fbf5878dbcd8`	Hash identified in the article as an AsyncRAT sample.
SHA256	`f8d2c5cb898cf92495fdcb7e20f509603e1bdd62ba4b61bd7694a8e33a4c738f`	Listed among hashes of VBS downloaders associated with the campaign.
URL	`hxxps[:]//hs8[.]krakenfiles[.]com/uploads/15-02-2026/JCaF7rrPQm/image.png`	KrakenFiles-hosted URL used to deliver the VBS downloader and PowerShell dropper.