LightSpy

experts detected a large-scale watering-hole attack aimed at residents of Hong Kong... The malware landed on victims’ smartphones when they visited one of several websites disguised as local news resources | All it took for the iPhone to get infected was one visit to a malicious page. There was no need even to tap anything.

The sites loaded a whole bunch of exploits onto victims’ smartphones, resulting in the installation of LightSpy.

Links to the fake sites were distributed through forums popular with Hong Kongers.

LightSpy malware is a modular backdoor that lets an attacker remotely execute commands on the infected device

Bootdestroy plugin... will spawn the shell and execute the following shell command: /usr/sbin/nvram auto-boot=false .

FrameworkLoader will call two functions: _inject and trustBin... copied from the 'jelbrek.m' file... This file will try to inject libcynject.dylib into SpringBoard process.

They utilized the publicly available Safari exploit CVE-2020-9802 for initial access... a WebKit vulnerability was used as an initial attack vector.

Since the Core is a shared library file, the FrameworkLoader will execute it using 'dlopen' system function...

b.plist, is a plist file that indicates that FrameworkLoader should start during system boot process.

They utilized the publicly available Safari exploit CVE-2020-9802 for initial access and CVE-2020-3837 for privilege escalation.

b.plist, is a plist file that indicates that FrameworkLoader should start during system boot process.

The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.

Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'

AppDelete... Can delete messenger-related victim files... BrowserDelete... can wipe browser history... ContactDelete... can delete specified contacts... MediaDelete... deleting media files... SMSDelete... deletes specified SMS message

To decrypt the URL configuration, the threat actor used the same XOR-chain algorithm... FrameworkLoader... will decrypt the configuration blob from its own body, this time using AES ECB cipher...

Since the Core is a shared library file, the FrameworkLoader will execute it using 'dlopen' system function...

the backdoor has modules for stealing information from Keychain (iOS’s password and encryption key storage)

p12 – signing certificate file which will be used to whitelist test file

Royal can scan the network interfaces of targeted systems. LightSpy reads the host's Wi‑Fi connection history and utilizes Apple's CWWiFiClient API to scan for nearby Wi‑Fi networks and obtain SSID, security type, and RSSI values.

get its contact list and call history

The content repeatedly describes threat actors and malware performing network scanning, port scanning, service enumeration, OS fingerprinting, and identifying open ports/services across victim environments.

The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.

AbstractEmu can collect device IP address and SIM information; Android/SpyAgent has collected device network information, such as the IMEI and the phone number; ANDROIDOS_ANSERVER.A gathers the device IMEI and IMSI; many listed mobile malware families collect IMEI, IMSI, ICCID, MEID, serial number, phone number, MAC address, IP address, carrier, MCC/MNC, and related device/network identifiers.

SoftInfo 2.0.0 The plugin exfiltrates the list of installed apps and running processes

Location 2.0.0 Location exfiltration plugin

AbstractEmu can collect files from or inspect the device’s filesystem. AhRat can find and exfiltrate files with certain extensions, such as .jpg, .mp4, .html, .docx, and .pdf. BOULDSPY can access browser history and bookmarks, and can list all files and folders on the device.

Screen_cap 2.0.0 Screen capture plugin

EnvironmentalRecording 1.0.0 Sound recording plugin: environment, calls

cameramodule 1.0.0 Takes camera shots. Can do a one-shot or take several shots for a specified time interval

as well as data from the WeChat, QQ, and Telegram messaging apps

SSZipArchive... to extract decrypted plugins Zip archives, resources.zip file, and to compress exfiltrated data.

Libwebsockets, for C2 communication... all communication with the control server will be done using only the Core... via Web socket.

The content repeatedly describes threat actors, malware, and campaigns using HTTP and/or HTTPS for command and control, including examples such as BlackEnergy communicating with C2 over HTTP POST requests and many other families using HTTP/S for C2. | Examples include 'Drovorub ... initiated communication with C2 servers with an HTTP Upgrade request' and 'COATHANGER uses an HTTP GET request to initialize a follow-on TLS tunnel for command and control.'

In case of successful exploitation, index.html will drop in the system a file with a '.png' extension... '20012001330.png' will download file 'aaa13'... FrameworkLoader is responsible for downloading the LightSpy Core and related plugins.

ADVSTORESHELL exfiltrates data over the same channel used for C2... Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers... numerous malware and groups sent victim data, files, credentials, or host information over existing C2 channels.

Bootdestroy plugin... preventing the system to boot up... execute /usr/sbin/nvram auto-boot=false

One particular campaign included plugins that could disrupt the operating system’s stability, with capabilities to freeze the device or even prevent it from booting up.