Loading malware…
LightSpy is a Chinese-linked modular spyware platform used for surveillance, credential theft, and remote control of compromised devices. Its platform coverage includes iOS, Android, macOS, Windows, Linux, and routers. It has been deployed in Operation Poisoned News against Hong Kong users, with subsequent activity extending across multiple countries, including the United States and European nations. The platform has also been associated with commercial surveillance offerings marketed to government, military, and enterprise customers; specific customer identities and its precise relationship with the Chinese government are not publicly established.
LightSpy uses a loader, a central command-processing component, and dynamically downloaded plugins. Its capabilities include collecting contacts, call logs, SMS messages, precise location, browser history, installed applications, running processes, and device and network information. Specialized plugins extract messaging data from applications including WeChat, QQ, Telegram, and WhatsApp. Apple variants can extract passwords, certificates, and cryptographic keys from Keychain. Other modules support microphone recording, camera capture, screen recording, local-network discovery, remote shell execution, and extensive file manipulation. Collected information is exfiltrated to command-and-control infrastructure using application-layer communications, including HTTPS and WebSockets. Configuration and payload components use encryption or obfuscation, and Apple infection chains establish persistence through launch services.
Documented delivery includes watering-hole and drive-by attacks using malicious pages disguised as local news, with links circulated through Hong Kong forums. Infection chains exploit browser vulnerabilities followed by privilege escalation. Historical macOS attacks used CVE-2018-4233 and CVE-2018-4404, while documented iOS chains used vulnerabilities including CVE-2019-8605, CVE-2020-9802, and CVE-2020-3837. An expanded iOS plugin set also includes destructive functionality capable of deleting data, disrupting system services, and preventing devices from booting.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
In January 2020, a watering hole was discovered that utilized a full remote iOS exploit chain to deploy a feature-rich implant named LightSpy.
51 distinct techniques documented for this family, organized by ATT&CK tactic.
Notably, LightSpy has been observed infecting routers, a new tactic that grants attackers visibility and access to all devices on a compromised network.
The researchers said that LightSpy has now been identified infecting routers, which researchers say they had not seen before. By attacking routers, the hackers can gain visibility and access to any other device on the same network.
Users with unpatched iPhones that access the concerned links will be infected with an iOS malware that can spy on and take full control of the devices. | Trend Micro discovered a watering hole attack against iOS users in Hong Kong... The campaign designed several webpages disguised as local news pages then injected them with an iframe that loads an iOS exploit.
The sites loaded a whole bunch of exploits onto victims’ smartphones, resulting in the installation of LightSpy.
We found that the campaign tricked users into clicking on the malicious news links by posting them on popular forums in Hong Kong.
Links to the fake sites were distributed through forums popular with Hong Kongers.
After downloading all the payloads, the exploit spawns a daemon using launchctl with “ircbin.plist” as the argument.
The iOS malware, which we named "lightSpy"... allowed the attacker to remotely execute a shell command...
This module is mainly used for executing shell commands... The popen function is used to fork a child process and execute shell commands.
FrameworkLoader will call two functions: _inject and trustBin... copied from the 'jelbrek.m' file... This file will try to inject libcynject.dylib into SpringBoard process.
[LightSpy](https://attack.mitre.org/software/S1185)'s main executable and module `.dylib` binaries are loaded using a combination of `dlopen()` to load the library, `_objc_getClass()` to retrieve the class definition, and `_objec_msgSend()` to invoke/execute the specified method in the loaded class.(Citation: Huntress LightSpy macOS 2024)
The full exploit chain involves exploiting a silently patched Safari bug on multiple recent iOS versions and a customized kernel exploit.
Since the Core is a shared library file, the FrameworkLoader will execute it using 'dlopen' system function...
This daemon uses irc_loader as an executable. This loader is just a launcher and will be used to start up the main malicious agent deployed on the target side.
After downloading all the payloads, the exploit spawns a daemon using launchctl with “ircbin.plist” as the argument.
b.plist, is a plist file that indicates that FrameworkLoader should start during system boot process.
This daemon uses irc_loader as an executable. This loader is just a launcher and will be used to start up the main malicious agent deployed on the target side.
After downloading all the payloads, the exploit spawns a daemon using launchctl with “ircbin.plist” as the argument.
Once the Safari browser renders the exploit, a silently patched bug is taken advantage of, which leads to the exploitation of a known kernel vulnerability to gain root privileges. The exploited kernel bug has been assigned with the CVE ID CVE-2019-8605.
b.plist, is a plist file that indicates that FrameworkLoader should start during system boot process.
The startup parameters are hidden in the irc_loader binary and are encrypted with the AES algorithm.
[LightSpy](https://attack.mitre.org/software/S1185)'s configuration file is appended to the end of the binary. For example, the last `0x1d0` bytes of one sample is an AES encrypted configuration file with a static key of `3e2717e8b3873b29`.(Citation: Huntress LightSpy macOS 2024)
It first gets the plug-in name, path, and classname, then uses the path to load the plug-in file through the dlopen() function. After that, it uses the objc_getClass() function to get the exposed class object...
[LightSpy](https://attack.mitre.org/software/S1185) encrypts the C2 configuration file using AES with a static key, while the module `.dylib` files use a rolling one-byte encoding for obfuscation.(Citation: Huntress LightSpy macOS 2024)
...and can also remotely wipe devices.
AppDelete... Can delete messenger-related victim files... BrowserDelete... can wipe browser history... ContactDelete... can delete specified contacts... MediaDelete... deleting media files... SMSDelete... deletes specified SMS message
To decrypt the URL configuration, the threat actor used the same XOR-chain algorithm... FrameworkLoader... will decrypt the configuration blob from its own body, this time using AES ECB cipher...
On macOS, [LightSpy](https://attack.mitre.org/software/S1185) checks the existence of a process identification number (PID) file, `/Users/Shared/irc.pid`, to verify if [LightSpy](https://attack.mitre.org/software/S1185) is currently running.(Citation: Huntress LightSpy macOS 2024)
Since the Core is a shared library file, the FrameworkLoader will execute it using 'dlopen' system function...
This module is mainly used for file or directory operation, including... upload file, download file, delete file, create directory, rename file, move file, copy file...
The campaign also employs modules specifically designed to exfiltrate data from popular messenger applications such as QQ, WeChat, and Telegram.
“Once installed, the spyware can collect sensitive information such as ... stored passwords.”
[LightSpy](https://attack.mitre.org/software/S1185) performs an in-memory keychain query via `SecItemCopyMatching()` then formats the retrieved data as a JSON blob for exfiltration.(Citation: Huntress LightSpy macOS 2024)
The payload, payload.dylib, is signed using the Apple developer certificate chain, probably to evade detection.
Royal can scan the network interfaces of targeted systems. LightSpy reads the host's Wi‑Fi connection history and utilizes Apple's CWWiFiClient API to scan for nearby Wi‑Fi networks and obtain SSID, security type, and RSSI values.
get its contact list and call history
To collect data on the host's Wi-Fi connection history, [LightSpy](https://attack.mitre.org/software/S1185) reads the `/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist file`.It also utilizes Apple's CWWiFiClient API to scan for nearby Wi-Fi networks and obtain data on the SSID, security type, and RSSI (signal strength) values.(Citation: Huntress LightSpy macOS 2024)
If sent the command `16002`, [LightSpy](https://attack.mitre.org/software/S1185) uses the `NSWorkspace runningApplications()` method to collect the process ID, path to the executable, bundle information, and the filename of the executable for all running applications.(Citation: Huntress LightSpy macOS 2024)
[LightSpy](https://attack.mitre.org/software/S1185)'s second stage implant uses the `DeviceInformation` class to collect system information, including CPU usage, battery statistics, memory allocations, screen size, etc.(Citation: Huntress LightSpy macOS 2024)
[LightSpy](https://attack.mitre.org/software/S1185) uses the `NSFileManager` to move, create and delete files. [LightSpy](https://attack.mitre.org/software/S1185) can also use the assembly `bt` instruction to determine a file's executable permissions.(Citation: Huntress LightSpy macOS 2024)
To collect data on the host's Wi-Fi connection history, [LightSpy](https://attack.mitre.org/software/S1185) reads the `/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist` file. It also utilizes Apple's `CWWiFiClient` API to scan for nearby Wi-Fi networks and obtain data on the SSID, security type, and RSSI (signal strength) values.(Citation: Huntress LightSpy macOS 2024)
If sent the command `16001`, [LightSpy](https://attack.mitre.org/software/S1185) uses the `NSFileManger contentsOfDirectoryAtPath()` to enumerate the Applications folder to collect the bundle name, bundle identifier, and version information from each application's `info.plist` file. The results are then converted into a JSON blob for exfiltration.(Citation: Huntress LightSpy macOS 2024)
“Once installed, the spyware can collect sensitive information such as precise location data.”
It is capable of stealing sensitive data such as location, chat messages, screen recordings, and passwords...
[LightSpy](https://attack.mitre.org/software/S1185) uses Apple's built-in AVFoundation Framework library to access the user's camera and screen. It uses the `AVCaptureStillImage` to take a picture using the user's camera and the `AVCaptureScreen` to take a screenshot or record the user's screen for a specified period of time.(Citation: Huntress LightSpy macOS 2024)
[LightSpy](https://attack.mitre.org/software/S1185) uses Apple's built-in AVFoundation Framework library to capture and manage audio recordings then transform them to JSON blobs for exfiltration.(Citation: Huntress LightSpy macOS 2024)
cameramodule 1.0.0 Takes camera shots. Can do a one-shot or take several shots for a specified time interval
as well as data from the WeChat, QQ, and Telegram messaging apps
SSZipArchive... to extract decrypted plugins Zip archives, resources.zip file, and to compress exfiltrated data.
After that, it initializes a thread using the libwebsockets library to implement the messages' receiving function.
[LightSpy](https://attack.mitre.org/software/S1185)'s C2 communication is performed over WebSockets using the open source library SocketRocket with functionality such as, heartbeat, receiving commands, and updating command status.(Citation: Huntress LightSpy macOS 2024)
On macOS, [LightSpy](https://attack.mitre.org/software/S1185) downloads a `.json` file from the C2 server. The `.json` file contains metadata about the plugins to be downloaded, including their URL, name, version, and MD5 hash. [LightSpy](https://attack.mitre.org/software/S1185) retrieves the plugins specified in the `.json` file, which are compiled `.dylib` files. These `.dylib` files provide task and platform specific functionality. [LightSpy](https://attack.mitre.org/software/S1185) also imports open-source libraries to manage socket connections.(Citation: Huntress LightSpy macOS 2024)
To exfiltrate data, [LightSpy](https://attack.mitre.org/software/S1185) configures each module to send an obfuscated JSON blob to hardcoded URL endpoints or paths aligned to the module name.(Citation: Huntress LightSpy macOS 2024)
“It can also remotely delete files and potentially make compromised devices unusable.”
Bootdestroy plugin... preventing the system to boot up... execute /usr/sbin/nvram auto-boot=false
One particular campaign included plugins that could disrupt the operating system’s stability, with capabilities to freeze the device or even prevent it from booting up.
182 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
43 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.