--- title: China-linked LightSpy spyware caught targeting victims... description: Security researchers at Arctic Wolf have found that LightSpy, a modular spyware platform first discovered in 2018 and linked to Chinese state-backed hackers,... canonical: https://daily.dev/posts/china-linked-lightspy-spyware-caught-targeting-victims-in-13-countries-including-the-us-5bhsvtmbj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: China-linked LightSpy spyware caught targeting victims in 13 countries, including the US | daily.dev og:description: Security researchers at Arctic Wolf have found that LightSpy, a modular spyware platform first discovered in 2018 and linked to Chinese state-backed hackers,... og:url: https://daily.dev/posts/china-linked-lightspy-spyware-caught-targeting-victims-in-13-countries-including-the-us-5bhsvtmbj og:image: https://api.daily.dev/og/posts/5bHsvtmbj.png og:image:alt: China-linked LightSpy spyware caught targeting victims in 13 countries, including the US og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # China-linked LightSpy spyware caught targeting victims in 13 countries, including the US **[TechCrunch](https://daily.dev/sources/tc)** · 2 min read · 1 upvotes · 0 comments ## Summary Security researchers at Arctic Wolf have found that LightSpy, a modular spyware platform first discovered in 2018 and linked to Chinese state-backed hackers, has expanded to target victims in 13 countries including the US and several NATO member states. The platform has evolved into a commercial spyware-as-a-service operation with custom branding, billing, and demos, now targeting smartphones, Apple devices, Linux servers, Windows PCs, and — newly — routers. New capabilities include remote device wiping and data destruction. Researchers linked the operation to a specific Chinese contractor after one operator accidentally placed a KFC order using their real name and office address through the spyware's admin panel. The platform operates at least 117 servers globally. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the LightSpy spyware and what can it do? LightSpy is a modular spyware platform, first discovered in 2018 and linked to Chinese state-backed hackers, that has evolved into a commercial spyware-as-a-service operation. It targets smartphones, Apple devices, Linux servers, Windows PCs, and now routers, stealing location data, chat messages, screen recordings, and stored passwords, with the ability to remotely wipe compromised devices. _Security teams tracking commercial spyware threats like LightSpy follow ongoing coverage on daily.dev._ ### How did researchers link the LightSpy spyware operation to a specific Chinese contractor? Arctic Wolf researchers connected the latest LightSpy activity to a Chinese contractor after one of the spyware's operators used the platform's administrator panel to place a food delivery order with Kentucky Fried Chicken using his real name and office address, exposing his identity and employer. _Anyone researching threat actor attribution methods can follow real-world spyware investigations on daily.dev._ ### How many countries and servers has the LightSpy spyware network been found operating in? LightSpy has been found targeting victims in over a dozen countries, including the United States and countries across Europe, with some compromised routers belonging to NATO member nations. The platform operates a network of at least 117 servers spread across multiple countries worldwide. _Track the scale of active spyware campaigns like LightSpy through daily.dev's security coverage._ ## Similar posts on daily.dev - [UK government says 100 countries have spyware that can hack people’s phones](https://daily.dev/posts/uk-government-says-100-countries-have-spyware-that-can-hack-people-s-phones-awuapxqsg) · TechCrunch · 0 upvotes · 0 comments - [Chinese spy group caught lurking in Poland, Asia networks](https://daily.dev/posts/chinese-spy-group-caught-lurking-in-poland-asia-networks-9camnlgtt) · The Register · 1 upvotes · 0 comments - [Chinese hackers target telcos with new Linux, Windows malware](https://daily.dev/posts/chinese-hackers-target-telcos-with-new-linux-windows-malware-ql0h0a4gw) · BleepingComputer · 2 upvotes · 0 comments - [AI-Powered Espionage Campaign Targets Government Linux Infrastructure](https://daily.dev/posts/ai-powered-espionage-campaign-targets-government-linux-infrastructure-j5b4ue4rm) · Unit 42 · 0 upvotes · 0 comments - [China-Nexus Actor Spied on US Researchers Undetected for a Year](https://daily.dev/posts/china-nexus-actor-spied-on-us-researchers-undetected-for-a-year-hvasfiprt) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber) [View this post on daily.dev](https://daily.dev/posts/china-linked-lightspy-spyware-caught-targeting-victims-in-13-countries-including-the-us-5bhsvtmbj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"China-linked LightSpy spyware caught targeting victims in 13 countries, including the US","url":"https://daily.dev/posts/china-linked-lightspy-spyware-caught-targeting-victims-in-13-countries-including-the-us-5bhsvtmbj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/china-linked-lightspy-spyware-caught-targeting-victims-in-13-countries-including-the-us-5bhsvtmbj"},"datePublished":"2026-08-06T19:22:49.505Z","dateModified":"2026-09-14T06:28:31.081Z","description":"Security researchers at Arctic Wolf have found that LightSpy, a modular spyware platform first discovered in 2018 and linked to Chinese state-backed hackers,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7fad8dbb7ac0c93cdc45e02aa391532f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7fad8dbb7ac0c93cdc45e02aa391532f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"TechCrunch","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"TechCrunch","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tc","url":"https://daily.dev/sources/tc"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/china-linked-lightspy-spyware-caught-targeting-victims-in-13-countries-including-the-us-5bhsvtmbj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"TechCrunch","item":"https://daily.dev/sources/tc"},{"@type":"ListItem","position":3,"name":"China-linked LightSpy spyware caught targeting victims in 13 countries, including the US"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/china-linked-lightspy-spyware-caught-targeting-victims-in-13-countries-including-the-us-5bhsvtmbj#faq","mainEntity":[{"@type":"Question","name":"What is the LightSpy spyware and what can it do?","acceptedAnswer":{"@type":"Answer","text":"LightSpy is a modular spyware platform, first discovered in 2018 and linked to Chinese state-backed hackers, that has evolved into a commercial spyware-as-a-service operation. It targets smartphones, Apple devices, Linux servers, Windows PCs, and now routers, stealing location data, chat messages, screen recordings, and stored passwords, with the ability to remotely wipe compromised devices. Security teams tracking commercial spyware threats like LightSpy follow ongoing coverage on daily.dev."}},{"@type":"Question","name":"How did researchers link the LightSpy spyware operation to a specific Chinese contractor?","acceptedAnswer":{"@type":"Answer","text":"Arctic Wolf researchers connected the latest LightSpy activity to a Chinese contractor after one of the spyware's operators used the platform's administrator panel to place a food delivery order with Kentucky Fried Chicken using his real name and office address, exposing his identity and employer. Anyone researching threat actor attribution methods can follow real-world spyware investigations on daily.dev."}},{"@type":"Question","name":"How many countries and servers has the LightSpy spyware network been found operating in?","acceptedAnswer":{"@type":"Answer","text":"LightSpy has been found targeting victims in over a dozen countries, including the United States and countries across Europe, with some compromised routers belonging to NATO member nations. The platform operates a network of at least 117 servers spread across multiple countries worldwide. Track the scale of active spyware campaigns like LightSpy through daily.dev's security coverage."}}]} ```