A Chinese-linked spyware now sells itself to governments like a SaaS product

LightSpy, a modular spyware tool first detected in 2018 and long tied to Chinese state-aligned hackers, now operates as a commercial platform with custom branding, customer billing, and product demos aimed at governments, militaries, and enterprises, according to research published this week by cybersecurity firm Arctic Wolf (TechCrunch).

LightSpy now compromises network routers, a vector Arctic Wolf had not previously observed, and one that turns a single infected device into a window onto every other machine on the same network. LightSpy was previously known for going after smartphones, Apple devices, Linux servers, and Windows PCs. Some of the compromised routers are associated with NATO member countries, the researchers said, though they stopped short of calling the targeting a state operation (Straits Times).

The latest LightSpy build can remotely wipe and destroy data on a compromised device, a destructive step beyond the platform's earlier focus on data theft. Stolen data in the current campaign includes precise location, chat messages, screen recordings, and stored passwords.

Arctic Wolf mapped the operation to a network of at least 117 servers spread across multiple countries, and to victims in 13 countries including the United States and several in Europe. The body of the firm's report refers to the same footprint as "over a dozen." The scale matches a customer base that Arctic Wolf says extends well beyond a single intelligence service (Insurance Journal).

Custom branding, billing tiers, and product demos for prospective customers are built into the platform's admin panel. Arctic Wolf describes a single threat actor catering to governments, enterprises, and militaries, and uses the storefront mechanics to argue this is a commercial spyware platform rather than a one-off espionage tool (UNN).

One LightSpy operator allegedly placed a KFC order through the platform's admin panel using his real name and an office address, allowing Arctic Wolf to pivot from technical infrastructure to a real-world identity. The detail is the kind of human tell that turns a research report into a storyline. It is also the load-bearing fact in the attribution chain: without it, the geographic and linguistic threads into China are circumstantial.

LightSpy fits a broader pattern Arctic Wolf has flagged in the wider spyware market: state-tied offensive tooling is moving from bespoke, in-house capabilities toward private industry as a service. A Chinese-linked actor running that same playbook, with customer tiers and a sales pipeline, is a different shape of problem than a single state-run operation, and one security teams are only beginning to price in.

Arctic Wolf has not named the contractor. The KFC slip is the thinnest thread in the report. The router pivot, the destructive capability, and the storefront-style operation are the parts the industry is more likely to act on, because those are the parts the operator can change by shipping a feature, not by changing their habits.