LightSpy Spyware Operator Undone by a KFC Order in His Real Name

Cybersecurity specialists at Arctic Wolf have reported that LightSpy, a piece of spyware previously believed to be a tool of Chinese state-sponsored hackers, has grown into a commercial platform and is now targeting victims in more than a dozen countries — 13 of them, according to the researchers, including nations in Europe and the United States.

From a state tool to a commercial product

LightSpy was first discovered in 2018. Since then, Arctic Wolf estimates, the program has evolved into a full-fledged commercial platform run by a single player that offers its services to governments, corporations and militaries. The platform has its own branding, an invoicing system and demo versions for prospective clients — in other words, the spyware is sold almost like an ordinary enterprise service.

LightSpy has a modular architecture and is capable of targeting a wide range of devices: smartphones, Apple hardware, Linux servers and Windows PCs. Using exploits tailored to each platform, the program steals precise location data, correspondence, screen recordings and saved passwords. On top of that, the code can remotely wipe data and knock an infected device out of commission.

Attacks on routers and a server network

One new development is the infection of routers — something researchers had not seen from LightSpy before. Once a router is compromised, the attackers gain access to every device on the same network. Some of the infected routers, according to Arctic Wolf, belong to NATO member states. In total, the LightSpy infrastructure comprises at least 117 servers in various countries around the world.

How a lunch order gave the operator away

The most remarkable detail of the investigation turned out to be an utterly mundane one. Researchers were able to link the recent activity to a specific Chinese contractor after one of the operators used the LightSpy admin panel to order food from Kentucky Fried Chicken — and did so under his real name and office address.

The episode is yet another reminder that the market for commercial spyware keeps expanding, spilling out beyond government structures into the private sector. And that even the most carefully planned surveillance operations sometimes trip over the human habit of ordering chicken delivered to the office.

Source: TechCrunch