Cybersecurity researchers have uncovered evidence that the Chinese-linked LightSpy spyware platform has expanded its operations beyond mainland China, targeting victims in more than a dozen countries across Europe, North America and Asia.
Researchers at cybersecurity firm Arctic Wolf said the malware, first identified in 2018 and previously associated with Chinese state-backed hackers, has evolved into a commercial spyware platform marketed to governments, military organisations and enterprise customers.
According to the researchers, the platform now includes commercial features such as custom branding, billing systems and demonstration tools for prospective clients.
The findings highlight the growing commercialisation of advanced spyware technologies, which are increasingly being deployed beyond state-sponsored intelligence operations.
LightSpy is a modular surveillance platform capable of compromising a wide range of devices, including Android smartphones, Apple devices, Windows computers, Linux servers and network routers.
Once deployed, the spyware can collect sensitive information such as location data, chat messages, passwords and screen recordings. Researchers also found that it includes capabilities to remotely erase data and render compromised devices inoperable.
One of the report’s most significant findings is the malware’s newly discovered ability to infect internet routers, allowing attackers to monitor and gain access to multiple devices connected to the same network.
Arctic Wolf said some compromised routers were located within NATO member countries.
The researchers identified at least 117 command-and-control servers supporting the spyware’s operations across multiple countries.
They also linked the latest campaign to a Chinese contractor after discovering that one of the spyware operators allegedly used the LightSpy administrative panel to place an order with Kentucky Fried Chicken using his real name and office address.
Arctic Wolf said the discovery provides one of the strongest attribution clues yet linking the spyware’s operators to a specific individual.
