Hackers target Apple device users because they are perceived to be of higher social classes. This leads to targets who are richer than others and who can possibly provide more money to the hackers in one way or another.

Besides this, Apple’s ecosystem is interconnected, which means it has various points from which hackers can enter, leading to the compromise of accounts and devices.

BlackBerry cybersecurity researchers recently discovered that LightSpy hackers are actively targeting Indian Apple device users to steal sensitive data.

LightSpy Hackers & Their Targets

LightSpy is a modular spying toolkit that can steal victims’ personal information, such as actual GPS coordinates or VOIP calls.

This new threat is dangerous because it allows hackers to follow targets with an exceptional degree of accuracy, expanding the potential impacts of this expansive surveillance on high-profile victims in politically sensitive regions.

LightSpy has an extensive spying capacity and can be used to monitor device data, QQ messenger content, WeChat messages, Telegram chats, and WeChat Pay history.

This highly effective software program returned during escalated regional hostilities after its 2020 operations had focused on Hong Kong-oriented news websites for distribution. 

The threat group, based in servers located in Russia, China, and Singapore, is very interested in monitoring victims involved in clashes of interests across South Asia.

This again highlights how even the slightest flare-ups pose a constant danger to the people involved there.

The motives behind this campaign and the geopolitical implications for Southern Asia that it has raised become sources of worry because of suspected links with China.

Hyper-targeted attacks like these may impact only a tiny fraction of individuals, such as journalists, activists, or politicians, but at the same time can be seen as a worldwide threat.

Tech companies have recently pointed out the danger of state-sponsored election tampering. According to Apple, powerful mercenary spyware is one of the most complex digital threats in existence.

When the vulnerability is detected on news websites specifically reporting Hong Kong issues, the infection usually starts. 

The attack advances with an initial implant, which collects device data and downloads successive stages.

These include LightSpy, which is the core implant, and special spying plugins.

The Loader starts by loading both the LightSpy kernel in encrypted form and decrypted form, BlackBerry said.

The recent campaign uses “F_Warehouse” framework that has various functionalities including file exfiltration, network reconnaissance, and audio recording. 

Besides this, executing shell commands can give full control to an attacker.

While the LightSpy maintains communication with its server as well as with an administrative panel that helps enhance its probable origin.

Recommendations

Here below we have mentioned all the recommendations:-

• Exercise heightened vigilance
• Use of Lockdown mode
• Use highly secure voice and messaging solutions
• Review the latest threat intelligence
• Create an incident response plan
• Update your devices
• Use a passcode
• Enable 2FA
• Beware of unofficial software
• Password hygiene
• Think before you click
• Restart your phone often

Looking to Safeguard Your Company from Advanced Cyber Threats? Deploy TrustNet to Your Radar ASAP.