China-Linked LightSpy Spyware Expanded Into a Global Multi-Platform Espionage Tool

Arctic Wolf researchers reported that LightSpy, a spyware family first identified in 2018, has expanded from targeting mainland China to victims in 13 countries, including the United States and parts of Europe. The malware has evolved into a modular commercial spyware platform that can infect smartphones, Apple devices, Linux servers, Windows PCs, and routers, reportedly serving governments, enterprises, and militaries through custom branding and billing.

Researchers said LightSpy can steal location data, chat messages, screen recordings, and passwords, while also giving operators the ability to remotely wipe or destroy data on compromised devices. Its expansion to routers is especially significant because it can provide visibility into all devices on affected networks; some compromised routers were linked to NATO member countries. Arctic Wolf identified at least 117 servers supporting the operation worldwide and said an operational security mistake in the administration panel exposed the activity's link to a Chinese contractor.