Friday, May 24, 2024

LightSpy Hackers Target Indian Apple Device Users To Steal Sensitive Data

Hackers target Apple device users because they are perceived to be of higher social classes. This leads to targets who are richer than others and who can possibly provide more money to the hackers in one way or another.

Besides this, Apple’s ecosystem is interconnected, which means it has various points from which hackers can enter, leading to the compromise of accounts and devices.

BlackBerry cybersecurity researchers recently discovered that LightSpy hackers are actively targeting Indian Apple device users to steal sensitive data.

LightSpy Hackers & Their Targets

LightSpy is a modular spying toolkit that can steal victims’ personal information, such as actual GPS coordinates or VOIP calls.

This new threat is dangerous because it allows hackers to follow targets with an exceptional degree of accuracy, expanding the potential impacts of this expansive surveillance on high-profile victims in politically sensitive regions.

LightSpy has an extensive spying capacity and can be used to monitor device data, QQ messenger content, WeChat messages, Telegram chats, and WeChat Pay history.

Stop Advanced Phishing Attack With AI

AI-Powered Protection for Business Email Security

Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Stopping 99% of phishing attacks missed by other email security solutions. .

This highly effective software program returned during escalated regional hostilities after its 2020 operations had focused on Hong Kong-oriented news websites for distribution. 

The threat group, based in servers located in Russia, China, and Singapore, is very interested in monitoring victims involved in clashes of interests across South Asia.

This again highlights how even the slightest flare-ups pose a constant danger to the people involved there.

The motives behind this campaign and the geopolitical implications for Southern Asia that it has raised become sources of worry because of suspected links with China.

Hyper-targeted attacks like these may impact only a tiny fraction of individuals, such as journalists, activists, or politicians, but at the same time can be seen as a worldwide threat.

Tech companies have recently pointed out the danger of state-sponsored election tampering. According to Apple, powerful mercenary spyware is one of the most complex digital threats in existence.

When the vulnerability is detected on news websites specifically reporting Hong Kong issues, the infection usually starts. 

Loader’s signature (Source – BlackBerry)

The attack advances with an initial implant, which collects device data and downloads successive stages.

These include LightSpy, which is the core implant, and special spying plugins.

The Loader starts by loading both the LightSpy kernel in encrypted form and decrypted form, BlackBerry said.

The recent campaign uses “F_Warehouse” framework that has various functionalities including file exfiltration, network reconnaissance, and audio recording. 

Besides this, executing shell commands can give full control to an attacker.

While the LightSpy maintains communication with its server as well as with an administrative panel that helps enhance its probable origin.


Here below we have mentioned all the recommendations:-

  • Exercise heightened vigilance
  • Use of Lockdown mode
  • Use highly secure voice and messaging solutions
  • Review the latest threat intelligence
  • Create an incident response plan
  • Update your devices
  • Use a passcode
  • Enable 2FA
  • Beware of unofficial software
  • Password hygiene
  • Think before you click
  • Restart your phone often

Looking to Safeguard Your Company from Advanced Cyber Threats? Deploy TrustNet to Your Radar ASAP.


Latest articles

Hackers Weaponizing Microsoft Access Documents To Execute Malicious Program

In multiple aggressive phishing attempts, the financially motivated organization UAC-0006 heavily targeted Ukraine, utilizing...

Microsoft Warns Of Storm-0539’s Aggressive Gift Card Theft

Gift cards are attractive to hackers since they provide quick monetization for stolen data...

Kinsing Malware Attacking Apache Tomcat Server With Vulnerabilities

The scalability and flexibility of cloud platforms recently boosted the emerging trend of cryptomining...

NSA Releases Guidance On Zero Trust Maturity To Secure Application From Attackers

Zero Trust Maturity measures the extent to which an organization has adopted and implemented...

Chinese Hackers Stay Hidden On Military And Government Networks For Six Years

Hackers target military and government networks for varied reasons, primarily related to spying, which...

DNSBomb : A New DoS Attack That Exploits DNS Queries

A new practical and powerful Denial of service attack has been discovered that exploits...

Malicious PyPI & NPM Packages Attacking MacOS Users

Cybersecurity researchers have identified a series of malicious software packages targeting MacOS users.These...
Tushar Subhra Dutta
Tushar Subhra Dutta
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles