Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Tracking LightSpy: Certificates as Windows into Adversary Behavior

hunt.io | blog | #threat-hunting | #surveillance | #spyware | #apac | #tls-certificates | #lightspy

Summary

Hunt profiles LightSpy's infrastructure, tracking its servers mainly in China and Hong Kong via unique TLS certificates; it exfiltrates WeChat, Telegram and QQ data from mobile devices.
Published
Collected

original ↗

Related coverage

blog · hunt.io
LightSpy Malware Now Targets Facebook & Instagram Data
A newly seen LightSpy server shows an expanded command list targeting Facebook and Instagram database files, as Hunt tracks eight active servers via TLS certificates.
blog · hunt.io
How We Identify Malicious Infrastructure At Hunt.io
Hunt explains how it identifies, tracks and 'burns' malicious C2 servers using TLS certificates, HTTP headers, SSH keys, JARM/JA4x hashes and TCP banners, seen in Gh0st and ShadowPad cases.
blog · hunt.io
Discovering & Disrupting Malicious Infrastructure
Hunt shows proactive hunting: pivoting on certificate names from Microsoft's Flax Typhoon report yielded four unreported SoftEther servers, plus Cobalt-related files found via keyword search.
blog · hunt.io
A Practical Guide to Uncovering Malicious Infrastructure With Hunt.io
A step-by-step infrastructure hunting walkthrough: from an AsyncRAT-linked IP, pivoting through ASN data, ports, services and TLS certificates to uncover a wider cluster of systems.
blog · hunt.io
Canis C2 Exposed: Previously Undocumented Cross-Platform Surveillance Framework Targeting Japan
An unauthenticated API on a Japanese phishing server exposed Canis C2, a previously undocumented cross-platform surveillance framework with agents for Android, iOS, Windows, Linux and macOS.
blog · hunt.io
Announcing Hunt 2.5
Hunt 2.5 adds a Pivots table tying IPs to certificate subjects, hashes, and TLS fingerprints, 50+ certificate fields in HuntSQL, an Add to Query button, and a downloadable phishing feed.
back