# China-linked LightSpy spyware targets victims across 13 countries New espionage activities detected against targets in the US and Europe - **Source:** [cybersecurity | TechCrunch](https://brifing.si/source/73fbb25c-5e90-44c9-9a24-7906dc3436cd) - **Published:** 2026-08-06 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/9ca0a9b0-7dfa-4591-b622-539bac4554cc ## LightSpy's global expansion Security researchers at Arctic Wolf have confirmed that the China-linked LightSpy spyware is active in 13 countries. Targets include institutions in the US and various European nations. First discovered in 2018, the malware was initially connected to state-sponsored hacker groups but has now transformed into a commercial platform operated by a single threat actor. The platform offers customized espionage services for governments, militaries, and corporations. ## Equipped with new capabilities LightSpy can now not only steal data but also remotely brick compromised devices. Its modular architecture enables targeted attacks against different device types including smartphones, Apple devices, Linux servers, and Windows PCs. The malware can extract sensitive information like location data, chat messages, screen recordings, and stored passwords. It also has the capability to remotely wipe data from infected devices. ## New attack vector targeting routers Researchers detected LightSpy infecting routers for the first time, allowing hackers to gain access to all devices on the same network. Some compromised routers belong to NATO member countries. Router compromises pose particularly critical threats to corporate networks as they can lead to large-scale data breaches. ## Global server infrastructure LightSpy operators use a network of at least 117 servers deployed worldwide. The platform's commercial model offers customers custom branding, billing, and demo features. Researchers highlight how spyware is proliferating beyond governments into the private sector. ## Operator mistake provided crucial lead Investigators traced the malware to a Chinese contractor after an operator used the LightSpy admin panel to order KFC with his real name and office address. This mistake provided critical evidence in tracking the spyware operations, demonstrating how human error can be decisive in cybersecurity investigations. ## Dangers of modular architecture LightSpy's modular design offers customizable attack tools for different needs, making the malware continuously upgradable and adaptable to new threats. The platform's demo and marketing features showcase 'service' capabilities to potential clients. This commercial approach facilitates non-state actors' access to sophisticated spying tools. ## Growing industry concerns The LightSpy case demonstrates how the commercial spyware market has grown and threat levels have increased. Security experts warn that proliferation of such tools in the private sector elevates global cybersecurity risks. Targeting routers of NATO countries could potentially escalate international tensions. ## Protection measures and implications Experts emphasize that organizations must strengthen network security and regularly update critical infrastructure components like routers. Behavioral analysis-based solutions are recommended for detecting advanced threats like LightSpy. This incident shows how cyber espionage is increasingly blurring lines between state and private sectors, necessitating reevaluation of global cybersecurity policies. ## Sources covering this story - https://techcrunch.com/2026/08/06/china-linked-lightspy-spyware-caught-targeting-victims-in-13-countries-including-the-us/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._