Threat Group Cards: A Threat Actor Encyclopedia Archived: 2026-04-05 14:41:20 UTC Home > List all groups > List all tools > List all groups using tool lightSpy Tool: lightSpy Names lightSpy Category Malware Type Reconnaissance, Backdoor, Info stealer, Exfiltration Description (Trend Micro) The iOS malware, which we named 'lightSpy' (detected by Trend Micro as IOS_LightSpy.A), is a modular backdoor that allowed the attacker to remotely execute a shell command and manipulate files on the infected device. It is also implemented with several functionalities through different modules for exfiltrating data from the infected device including: • Hardware information • Contacts • Keychain • SMS messages • Phone call history • GPS location • Connected Wi-Fi history • Browser history of Safari and Chrome The malware also reports the surrounding environment of the device by: • Scanning local network IP address • Scanning available Wi-Fi network The campaign also employs modules specifically designed to exfiltrate data from popular messenger applications such as QQ, WeChat, and Telegram. Information https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=4c9d4f77-ee82-4452-b187-84072275951e Page 1 of 2 MITRE ATT&CK Malpedia Last change to this tool card: 28 June 2025 Download this tool card in JSON format All groups using tool lightSpy Changed Name Country Observed APT groups   Operation Poisoned News, TwoSail Junk 2020   1 group listed (1 APT, 0 other, 0 unknown) Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=4c9d4f77-ee82-4452-b187-84072275951e https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=4c9d4f77-ee82-4452-b187-84072275951e Page 2 of 2