DragonEggMalware
- LightSpy
Android variant of ios. LightSpy.From MISP Galaxy
Last reported 18 months ago, by Huntress5 reports
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“Hot take: SSL VPNs without MFA are as big of a target as exposed Remote Desktop Protocol (RDP) and Remote Monitoring and Management (RMM) software, and are more dangerous.”
- T1027.006HTML Smuggling
“HTML Smuggling Tradecraft”
- T1036Masquerading
“Still, this development helps crack down on macOS malware that tries to bypass TCC through bombarding users with TCC prompts or masquerading as legitimate software.”
- T1110Brute Force
“September also brought us brute-force attacks on accounting software used by contractors, exposing the need for better credential hygiene across industries.”
- T1543.001Launch Agent
“…ng Launch Daemons, which are property list files (plist) on various locations on the disk that are executed at the system level, and Launch Agents, which require a user session and execute specific binaries from plists.”
- T1543.003Windows Service
“That means that instead of using Windows services or the registry for persistence, macOS malware will instead use different processes.”
What the reports say
5 reports, newest first · the exact sentence from each-
Say Hello to Mac Malware“More macOS malware variants have cropped up over the years, ranging from frustrating adware (like Adload) to insidious spyware (like LightSpy).”
-
2024: Revisiting a Year in Threats“LightSpy Malware”
-
One Order of Tips, Tricks & Hot Takes for Cybersecurity“State-sponsored malware, adware, advanced infostealers, and even spyware like LightSpy are what’s lurking in the shadows.”
-
Debunking 5 Major macOS Myths“…ome generic adware in the early-to-late 2000s has given way to nation-state-sponsored malware, advanced infostealers, and spyware, like LightSpy.”
-
LightSpy Malware Variant Targeting macOS“LightSpy Malware Variant Targeting macOS”
Indicators in its reports
named in the reports above- afd03337d1500d6a…df26786ea4a4in 1 report
- irc[.]pidin 1 report
- 0f66a4daba647486…f8a562bc306cin 1 report
- hxxps://blogs.blackberry[.]com/en/2024/04/lightspy-returns-renewed-espionage-campaign-targets-southern-asia-possibly-indiain 1 report
- hxxps://www.threatfabric[.]com/blogs/lightspy-mapt-mobile-payment-system-attackin 1 report
- www.threatfabric[.]comin 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.