Libyan Scorpions is a politically motivated cyber threat actor group, assessed with high confidence to be of Libyan origin, first observed conducting cyber espionage campaigns in September 2015. The group initially focused on targeting high-level influential and political figures within Libya, leveraging basic but effective social engineering and phishing tactics, often trojanizing legitimate Android applications to deploy their malware. Despite not always demonstrating highly technical sophistication in early operations, their effectiveness was amplified by operating within an active warzone, enabling them to track and monitor victims. The group's primary motivation is cyber espionage and sabotage, aimed at serving political interests. More recently, Libyan Scorpions has evolved its operational model, shifting focus to critical infrastructure in the energy sector and incorporating advanced ransomware techniques.