LightSpy Spyware Expands Global Reach, Targets 13 Countries Including US

LightSpy's Expanded Global Operations

Security researchers at Arctic Wolf have reported that the LightSpy spyware, initially discovered in 2018, has broadened its operational scope beyond mainland China. The spyware is now targeting individuals and entities in over a dozen countries, including the United States and various European nations. This expansion indicates a significant increase in the reach of the threat actor behind LightSpy.

New Capabilities and Commercialization

LightSpy has evolved into a commercial spyware platform, operated by a single threat actor who offers its services to governments, enterprises, and militaries. The platform includes custom branding, billing, and demonstration features for prospective clients. Its new functionalities allow for extensive data exfiltration, including precise location data, chat messages, screen recordings, and stored passwords. The spyware can also remotely wipe and destroy data on compromised devices.

Router Infections and Network Access

A notable development in LightSpy's deployment is its ability to infect routers, a method not previously observed by researchers. By compromising routers, the attackers gain visibility and access to all other devices connected to the same network. Arctic Wolf noted that some of the compromised routers are associated with NATO member countries, highlighting a potential national security concern.

Attribution and Infrastructure

Researchers were able to link the recent LightSpy activity to a Chinese contractor after one of the spyware's operators used the administrator's panel to place a Kentucky Fried Chicken order with their real name and office address. The spyware operates a network of at least 117 servers located in various countries globally, supporting its widespread operations.