The advanced LightSpy spyware, previously tied to Chinese state-backed threat actors, has significantly expanded its operations beyond mainland China, targeting victims across 13 countries including the United States and several European nations. Cybersecurity researchers at Arctic Wolf report that the tool has transformed into a commercial spyware platform marketed to governments, militaries, and enterprises.
LightSpy features modular capabilities that allow it to compromise a wide array of targets, ranging from smartphones and PCs to routers, including devices linked to NATO member states. Its advanced toolset enables data theft, precise location tracking, screen recording, and even the remote wiping or destruction of compromised devices.
This escalation highlights the growing commercialization of sophisticated cyber-espionage tools. Remarkably, researchers were able to link the operation to a Chinese contractor after an administrator accidentally used their real name and office address while placing a food order through the spyware’s control panel.
- LightSpy spyware now targets victims in 13 countries, including the US and Europe.
- The malware has evolved into a commercial platform sold to various clients.
- It can infect multiple devices, including routers belonging to NATO nations.
- Researchers traced operators back to a Chinese contractor following an operational security blunder.
Sources:
