Loading threat actor…
TwoSail Junk is a Chinese-speaking threat cluster identified in connection with a Hong Kong-focused watering-hole campaign observed in early 2020. The actor was associated with delivery of a full remote iOS exploit chain and the modular LightSpy surveillance implant, indicating an espionage-oriented operation centered on mobile-device compromise and victim monitoring. Activity suggests the campaign primarily targeted users in Hong Kong, with observed victim traffic also including Macau. The operation used watering-hole techniques and traffic seeding through forum posts and newly created discussion threads to lure targets to exploit infrastructure. The broader project was assessed to likely include Android support and probably implants for Windows, Linux, and macOS in addition to iOS, although the iOS component is the best-supported element. LightSpy was characterized as a modular surveillance framework, and the actor’s overall tradecraft and infrastructure were assessed as low-to-mid capability. Known aliases are limited to naming variants such as Two-Sail Junk and twosail_junk. No high-confidence linkage to a previously known intrusion set is established.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
1 malware family Mallory has associated with this actor across public reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.