A Chinese spyware tool operates in 13 countries, cyber firm says

WASHINGTON – A Chinese-built digital spyware tool has evolved into a more all-encompassing surveillance technology that’s in use in more than 13 countries, according to new research from a security firm.

The cybersecurity firm Arctic Wolf Networks Inc said on Aug 5 that it detected a malicious software platform, called LightSpy, which enables users to pay the company to steal victims’ personal information, including hyper-specific location data, sound recording, chat records, camera and video and screen recording and more.

The technology is also able to completely wipe someone’s personal device, according to Arctic Wolf.

The platform contains pricing tiers, billing infrastructure and branding, according to researchers.

The tool also contains a demo environment for prospective buyers, researchers said.

The identity of the LightSpy operators wasn’t clear.

Arctic Wolf said the tool was “linked to Chinese nation-states actors.”

The company said it was holding discussions with the Department of Homeland Security on the matter and that it would share its findings with the FBI.

The Chinese embassy in Washington didn’t immediately respond to a request for comment.

“As these capabilities proliferate, there is increased potential for sophisticated surveillance tools to spread and be used to monitor, intimidate, or suppress opposition voices,” said Justin Moore, director of threat intelligence research at Arctic Wolf.

“The challenge now is no longer just defending against nation-state actors, but against a growing ecosystem of organizations, cyber criminals, and governments with access to similar capabilities.”

As the global spyware market expands, this growth marks the beginning of a new demand for surveillance technology, researchers said.

Private firms like NSO Group are providing customers with spyware capable of monitoring smartphones.

“LightSpy reflects a broader shift in the spyware market as surveillance is becoming a product, not just a one-off operation or piece of malware. When advanced espionage capabilities can be packaged, sold, and reused, the number of bad actors capable of conducting sophisticated surveillance grows dramatically,” said Moore.

Cybersecurity specialists were able to track down a LightSpy operator based in China when the individual used the billing infrastructure to order fried chicken from Kentucky Fried Chicken, accidentally leaving his real name and office address in the code four years ago.

Customers across China including enterprises, government agencies, military organisations and educational institutions use LightSpy, the cyber firm said.

LightSpy has existed in some form for years.

Its infrastructure has expanded from China mainland to various other countries.

The organisation currently has 117 servers and operates malicious software in installed on network routers, allowing hackers to intercept and relay data in Europe and Africa. BLOOMBERG