Global Spyware Threat: LightSpy Expands Its Reach
Security researchers have uncovered evidence that a Chinese-linked spyware, LightSpy, has expanded its operations to target victims in over a dozen countries, including the US, Europe, and other regions. This modular spyware platform allows its operators to attack a wide range of devices, including smartphones, Apple devices, Linux servers, and Windows PCs.
Stealing Sensitive Information and Wiping Devices
LightSpy has evolved into a commercial spyware platform operated by a single threat actor who caters to governments, enterprises, and militaries. The platform features custom branding, billing, and demos for advertising it to prospective customers. The spyware can steal large amounts of sensitive information from its targets, including precise location data, chat messages, screen recordings, and stored passwords. Furthermore, the code is capable of remotely wiping and destroying data on a compromised device.
New Functionality and Router Attacks
The researchers have identified new functionality in LightSpy that allows its operators to attack routers, which they had not seen before. By attacking routers, the hackers can gain visibility and access to any other device on the same network. Some of the compromised routers are associated with NATO member countries, said Arctic Wolf.
Global Reach and Servers
According to the company, LightSpy operates a network of at least 117 servers in several countries around the world. The researchers were able to link the latest activity to a Chinese contractor after one of the spyware's operators used the LightSpy administrator's panel to place an order with Kentucky Fried Chicken using his real name and office address.
A Growing Concern
The findings underscore how the use of spyware continues to proliferate beyond governments and nation-backed hackers, and more broadly into the private industry. The use of commercial spyware platforms like LightSpy raises concerns about the potential for widespread exploitation and data breaches.