C2 infrastructure mimics sites belonging to the Libyan Ministry of Foreign Affairs. Earliest artifacts date back to October 2022. Suspected that threat actor is targeting Egyptian and Libyan journalists and human rights activists.