Cybersecurity researchers have uncovered a renewed cyber espionage campaign aimed at users in South Asia, featuring an Apple iOS spyware implant named LightSpy. The latest variant, known as ‘F_Warehouse,’ showcases a modular framework with extensive spying capabilities. Initial analysis suggests the campaign may have targeted India, based on VirusTotal submissions originating from within the country.

First documented in 2020, LightSpy is an advanced iOS backdoor typically distributed through watering hole attacks via compromised news sites. A recent analysis revealed infrastructure and functionality overlaps between LightSpy and an Android spyware called DragonEgg, associated with the Chinese nation-state group APT41.

The precise method of initial intrusion remains unknown, although it is suspected to occur through compromised news websites frequented by the targets. LightSpy operates as a fully-featured and modular espionage tool, capable of harvesting sensitive information such as contacts, SMS messages, location data, and sound recordings during VoIP calls.

The latest version of LightSpy expands its capabilities to include file theft and data extraction from popular apps like Telegram, QQ, and WeChat, as well as iCloud Keychain data and web browser history. The spyware also facilitates camera usage, audio recording, and execution of shell commands received from the server.

To evade detection, LightSpy employs certificate pinning to prevent interception of communication with its command-and-control (C2) server. Furthermore, an examination of the implant’s source code suggests the involvement of native Chinese speakers, indicating potential state-sponsored activity.

The resurgence of LightSpy underscores an escalation in mobile espionage threats, posing significant risks to individuals and organizations in Southern Asia. Its advanced capabilities, including extensive data exfiltration and potential full device control, highlight the urgency for enhanced cybersecurity measures in the region.