Chinese-linked LightSpy spyware expands to over a dozen countries

TechCrunch reports that a Chinese-linked spyware known as LightSpy has significantly expanded its reach, now targeting victims in more than a dozen countries across Europe and the United States, in addition to its previous focus on mainland China.

Security researchers at Arctic Wolf have found that LightSpy, initially discovered in 2018 and linked to Chinese state-backed hackers, has evolved into a commercial spyware platform. This platform is operated by a single threat actor who markets it to governments, enterprises, and militaries, offering custom branding and billing. The modular spyware can infect various devices, including smartphones, Apple devices, Linux servers, and Windows PCs, by exploiting device-specific vulnerabilities. It is capable of stealing sensitive data such as location, chat messages, screen recordings, and passwords, and can also remotely wipe devices.

Notably, LightSpy has been observed infecting routers, a new tactic that grants attackers visibility and access to all devices on a compromised network. Some of these targeted routers are associated with NATO member countries. The platform operates a network of at least 117 servers globally. Researchers linked the latest activity to a Chinese contractor after an operator used the LightSpy administrator panel to place a personal order with his real name and office address.

Source: TechCrunch