LightSpy Spyware Detected in 13 Countries, Including the US

The LightSpy spyware, suspected of being linked to China, has expanded its reach and begun targeting victims in 13 countries, including the US and several European nations. Experts have determined that this dangerous malware can not only steal data but also remotely disable devices completely. ixbt.com reports this. Techcrunch.com reports this.

According to researchers at the cybersecurity company Arctic Wolf, LightSpy was first discovered in 2018 and was initially linked to groups backed by the Chinese state. Over time, however, it evolved into a commercial spyware platform operated by a single threat actor serving governments, large corporations and the military. The platform is reportedly offering its clients custom branding, payment systems and even advertisements.

Broad Attacks and New Targets

LightSpy is a modular spyware platform that allows attackers to target various types of devices, including smartphones, Apple products, Linux servers and Windows PCs. By exploiting specific vulnerabilities, the malware can steal precise location data, chat messages, screen recordings and stored passwords.

Researchers say the software also includes functionality for remotely deleting and destroying all data on a compromised device. Most notably, LightSpy has reportedly infected a router for the first time in its history. By taking control of a router, hackers can gain access to any other device connected to the same network. Some of the compromised routers were found to belong to NATO member states.

The Investigation and Exposure

According to Arctic Wolf, LightSpy has been operating a network of at least 117 servers across several countries worldwide. Experts managed to link this activity to a Chinese contractor. One of the spyware's operators placed an order from a Kentucky Fried Chicken restaurant through the LightSpy administration panel using his real name and workplace address.

This case shows that cyberespionage is spreading not only through state-level covert operations but also across the private sector and commercial market. Experts recommend that users strengthen measures to protect the security of their networks and devices.