Following the news that Apple sent alerts warning iPhone owners in 92 countries that they may have been the subject of a spyware attack, a report appears to point the finger at a specific piece of malware that has links to China.
Apple sent the warnings to people in 92 countries last week, saying that “Apple detected that you are being targeted by a mercenary spyware attack that is trying to remotely compromise the iPhone associated with your Apple ID." The warning continued, saying that the "attack is likely targeting you specifically because of who you are or what you do. Although it’s never possible to achieve absolute certainty when detecting such attacks, Apple has high confidence in this warning — please take it seriously." But Apple didn't get into specifics. Now, it seems that BlackBerry researchers may have some answers.
According to BlackBerry, the alerts may have been sent as a response to the resurgence of the LightSpy mobile malware software "which focuses on targets in Southern Asia and probably India, potentially indicating a renewed focus on political targets and tensions in the region."
China-linked
A BlackBerry blog post explains that the malware first popped up in 2020 and that it "possesses modules designed to exfiltrate device information and saved files, including data from popular messenger applications such as QQ, WeChat, and Telegram."
As for the source of the attacks, some familiar names pop up. "The threat actor group thought to be behind this LightSpy campaign reportedly had active servers in China, Singapore, and Russia," BlackBerry says.
It's important to remember that these kinds of malware attacks aren't random, however, and most people are unlikely to need to worry about them. But journalists, members of government, and public figures are potentially at risk and should take action should they receive one of the messages sent out last week.
