LightSpy

ATP Sandbox Adv. HeuristicsAV

Stats

First seen: April 2024
Last seen: September 2026

Also known as

Lightspy

MITRE ATT&CK techniques

16 techniques across 7 tactics.

TA0002 Execution

T1129Shared Modules

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
- T1027.001Binary Padding
T1480Execution Guardrails

TA0006 Credential Access

T1555Credentials from Password Stores
- T1555.001Keychain

TA0007 Discovery

T1046Network Service Discovery
T1057Process Discovery
T1082System Information Discovery
T1083File and Directory Discovery
T1217Browser Information Discovery
T1518Software Discovery

TA0009 Collection

T1113Screen Capture
T1123Audio Capture

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1105Ingress Tool Transfer

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

Associated groups

G0096APT41

Alert name variants

Alert Name	Engine
Gen:Variant.LightSpy.1	AV
Gen:Variant.LightSpy.2	AV
Gen:Variant.LightSpy.3	AV
Gen:Variant.LightSpy.4	AV
Gen:Variant.LightSpy.5	AV
Gen:Variant.LightSpy.7	AV
Gen:Variant.LightSpy.9	AV
Gen:Variant.MAC.LightSpy.1	AV
Gen:Variant.Trojan.MAC.LightSpy.1	AV
Gen:Variant.Trojan.MAC.LightSpy.2	AV
MacOS.Trojan.LightSpy	ATP Sandbox Adv. Heuristics
Trojan.LightSpy.1	AV
Trojan.LightSpy.4	AV
Trojan.LightSpy.5	AV
Win32.Spyware.Lightspy	ATP Sandbox Adv. Heuristics
Win32.Trojan.LightSpy	ATP Sandbox Adv. Heuristics

Related families

Metamorfo Empire PlugX RedLine Stealer InvisiMole