“`html
Security researchers have uncovered a widespread campaign involving LightSpy, a sophisticated spyware platform with connections to China that is actively targeting individuals across at least 13 countries, including the United States and several NATO member nations. Arctic Wolf, a cybersecurity firm, reported that the malicious software has evolved significantly since its initial discovery in 2018, transforming from a state-level tool into a commercial platform offered to governments, enterprises, and military organizations.
The spyware demonstrates alarming capabilities across multiple device types, including smartphones, Apple products, Linux servers, and Windows computers. Once installed, LightSpy can extract sensitive data such as location information, communications, screen recordings, and stored credentials. Researchers noted a particularly concerning development: the malware can now compromise network routers, providing attackers access to all devices connected to the same network. Some infected routers belong to NATO-affiliated countries.
A critical breakthrough in the investigation occurred when one of the spyware operators inadvertently revealed their identity. The individual used the LightSpy control panel to place a food order, entering their real name and office address during the transaction. This operational mistake allowed researchers to trace the activity back to a Chinese contractor operating the platform through a network of approximately 117 servers worldwide, helping establish the connection between the spyware and Chinese entities.
“`
Originally reported by Techcrunch →
About the Author
