Arctic Wolf Networks identified LightSpy, a sophisticated spyware platform linked to Chinese state actors. The platform operates as a commercial surveillance tool in more than 13 countries.
The infrastructure has expanded to 117 servers with malware installed on network routers in Europe and Africa. Operators sell the software using pricing tiers and a demo environment.
The spyware steals personal data including location, audio recordings, and private chats. It also allows users to remotely wipe a victim’s device.
Researchers tracked one operator in China who left their real name and office address in the code while placing a KFC order four years ago.