A new cyber espionage campaign using the sophisticated iOS spyware implant known as LightSpy has been detected, which is focused in South Asia, primarily India, according to a recent BlackBerry report.

Dubbed 'F_Warehouse,' the latest iteration of LightSpy comes with a modular framework with extensive spying capabilities.

LightSpy first surfaced in 2020 and was mainly distributed through watering hole attacks via compromised news sites. The implant is known or its advanced iOS backdoor capabilities. Recent analysis has revealed similarities between LightSpy and DragonEgg, an Android spyware linked to the Chinese nation-state group APT41 (aka Winnti), hinting at a potentially sophisticated state-sponsored operation.

The malware allows threat actors to harvest a trove of sensitive information, including contacts, messages, location data, and even recordings of VoIP calls, posing a significant risk to targeted individuals and organizations alike.

LightSpy contains modules designed to exfiltrate device information and saved files, including data from popular messenger applications like QQ, WeChat, and Telegram. Additionally, it can access a user's contacts, SMS messages, phone call history, GPS location, connected WiFi history, and browser history from Safari and Chrome.

The attack involves a multi-stage process, starting with a first-stage implant that gathers device information and downloads further stages, including the core LightSpy implant and various plugins for specific spying functions. The Loader, responsible for initiating this process, loads both the encrypted and subsequently decrypted LightSpy kernel.

The core of LightSpy functions as a sophisticated espionage framework, capable of accommodating extensions through a plugin system. Each plugin, retrieved from the threat actor's server in an encrypted format and decrypted before execution, extends the functionality of the main LightSpy implant. The latest campaign involves the versatile framework 'F_Warehouse,' implementing a broad range of capabilities such as file exfiltration, audio recording, network reconnaissance, and credential theft, among others.

“The reemergence of LightSpy highlights the ongoing threat of sophisticated mobile spyware used for espionage purposes. The targeting of individuals in Southern Asia, coupled with the suspected Chinese origin of the attackers, raises concerns about the potential motives and geopolitical implications of this campaign,” the researchers noted.

Earlier this month, Apple updated its spyware threat notification system to add alerts for users who may have been specifically targeted in tailored surveillance campaigns.