LightSpy: China-Associated Spyware Discovered Attacking Targets Across 13 Nations, USA Included
Experts in cybersecurity have uncovered evidence that a spyware linked to China has expanded its reach from mainland China to target victims in more than a dozen nations, including locations in Europe and the U.S. This previously known spyware has gained new features that allow it to collect vast amounts of data and even disable devices remotely.
Researchers from Arctic Wolf, a cybersecurity firm, stated that the LightSpy spyware, which was initially detected in 2018 and previously associated with state-sponsored Chinese attacks, has developed into a commercial spyware platform run by a singular threat actor. This actor serves not just governmental bodies, but also enterprises and military organizations.
The platform is noted for offering tailored branding, billing options, and promotional demonstrations aimed at potential clientele.
These revelations highlight the growing trend of spyware being used not just by governmental agencies and state-sponsored hackers but increasingly within the private sector.
LightSpy is designed as a modular spyware platform that enables its operator to target a wide variety of devices, including smartphones, Apple devices, Linux servers, and Windows computers. It employs specific exploits tailored to each device type to absorb significant quantities of sensitive information from targets, which can include exact location data, messaging conversations, screen captures, and stored passwords. Furthermore, the spyware has the capacity to remotely erase and destroy data on an infected device.
Interestingly, the researchers noted that LightSpy has now been found infecting routers, a development they had not previously encountered. By compromising routers, the hackers gain visibility and access to any devices connected to the same network.
Some of these compromised routers are reportedly linked to NATO member nations, as indicated by Arctic Wolf.
The researchers assert that LightSpy operates a network comprising at least 117 servers spread across various countries worldwide.
The latest activity was traced back to a Chinese contractor when one of the spyware’s operators inadvertently used the LightSpy admin panel to order food from Kentucky Fried Chicken, revealing his real name and work address.
