MITRE ATT&CKsoftware (malware)
S1185 LightSpy
- Domain
- enterprise, mobile
- Platforms
- Android, Windows, iOS, macOS
- Version
- 1.0
- Created
- 2025-01-03
Description
First observed in 2018, LightSpy is a modular malware family that initially targeted iOS devices in Southern Asia before expanding to Android and macOS platforms. It consists of a downloader, a main executable that manages network communications, and functionality-specific modules, typically implemented as `.dylib` files (iOS, macOS) or `.apk` files (Android). LightSpy can collect VoIP call recordings, SMS messages, and credential stores, which are then exfiltrated to a command and control (C2) server.
Related
Uses · MITRE ATT&CK (51)
- T1027.013 Encrypted/Encoded File sub-technique
- T1422.002 Wi-Fi Discovery sub-technique
- T1662 Data Destruction technique
- T1660 Phishing technique
- T1658 Exploitation for Client Execution technique
- T1655 Masquerading technique
- T1642 Endpoint Denial of Service technique
- T1437.001 Web Protocols sub-technique
- T1634.001 Keychain sub-technique
- T1636.002 Call Log sub-technique
- T1636.003 Contact List sub-technique
- T1636.004 SMS Messages sub-technique
- T1646 Exfiltration Over C2 Channel technique
- T1623 Command and Scripting Interpreter technique
- T1631 Process Injection technique
- T1582 SMS Control technique
- T1575 Native API technique
- T1071.001 Web Protocols sub-technique
- T1555.001 Keychain sub-technique
- T1027.001 Binary Padding sub-technique
- T1544 Ingress Tool Transfer technique
- T1532 Archive Collected Data technique
- T1533 Data from Local System technique
- T1518 Software Discovery technique
- T1512 Video Capture technique
- T1513 Screen Capture technique
- T1509 Non-Standard Port technique
- T1480 Execution Guardrails technique
- T1217 Browser Information Discovery technique
- T1398 Boot or Logon Initialization Scripts technique
Referenced by MITRE ATT&CK · uses (1)
- G0096 APT41 group
References
- https://blogs.blackberry.com/en/2024/04/lightspy-returns-renewed-espionage-campaign-targets-southern-asia-possibly-india MelikovBlackBerry LightSpy 2024