LightSpy Spyware feature expands to Windows

The Chinese APT group behind the LightSpy Spywarehas expanded its functionality with a Windows-based surveillance framework, BlackBerry.

See also: LightSpy spyware: New version with powerful capabilities targets iOS

Focused on stealing information from infected devices, LightSpy was initially used in attacks against iPhone users in Hong Kong in 2020.

Multiple reports this year have shown that the operators of the LightSpy spyware have expanded their toolkit to target Android and macOS and expanded the malware's capabilities, including adding destructive modules.

Now BlackBerry, which attributes the attacks to the notorious Chinese hacking group APT41 (also known as Barium, Brass Typhoon, Bronze Atlas, Wicked Panda and Winnti), is describing another step in the evolution of the LightSpy spyware campaign, which has expanded to Windows systems.

With the addition of the DeepData for Windows, with its 12 add-ons specializing in information theft, the threat actor has extensive cross-platform espionage capabilities, supported by a sophisticated command and control (C&C) infrastructure.

See also: Predator Spyware Resurfaces with Increased Danger

According to BlackBerry, the surveillance capabilities of the APT41 group target communication platforms such as WhatsApp, Telegram, Signal, WeChat, Outlook, DingDing and Feishu, as well as browsers, password managers and large amounts of system and network data. The APT can also record audio to spy on victims.

DeepData, which is served from the hacking group's C&C server inside a ZIP file, has the same layout as the LightSpy spyware, consisting of a core module and multiple plugins that target various applications to steal information on Windows.

Audio recording capabilities are also packaged into a module that uses the system microphone and the open source FFmpeg for this action. Recordings are saved in .acc and sent to the attacker's server.

By examining the framework components, BlackBerry discovered that their development likely began around mid-2022, with most of the add-ons having been compiled in 2023.The core framework component, however, was compiled in March 2024, and the keylogging capabilities were added in October.

APT41 is believed to have developed DeepData for use in targeted attacks against entities in Southeast Asia, likely focusing on journalists, politicians, and political activists.

See also: EU: Activists call for stricter measures against spyware

Spyware, such as LightSpy, which now affects Windows, is a type of malicious software that installs itself on your computer or device without your knowledge. Its purpose is to monitor and collect information about your activities, which is then sent to third parties. This information can include browsing data, keystrokes, and even sensitive personal information such as passwords. The presence of spyware can cause serious security and privacy issues, making it especially important to have effective antivirus software and regularly update your operating system.

Source: securityweek