LightSpy Expands Surveillance Capabilities with Facebook and Instagram Data-Collection Commands

Feb 20, 2025 · Original article ↗

Summary

Researchers found LightSpy command-list entries for extracting Facebook and Instagram database files, a previously unreported core version, Windows surveillance plugins, and exposed administration endpoints across its infrastructure.

Key points

A newly observed LightSpy command-and-control server listed more than 100 commands across several platforms, compared with 55 on a previously reported server.
New Android commands reference collecting Facebook and Instagram database files, potentially exposing stored conversations, contacts, and account metadata.
Researchers identified a LightSpy core deployment date of December 31, 2021, which they say had not been publicly reported.
Windows plugins indicate surveillance capabilities including keylogging, audio and video capture, and USB interaction.
An exposed `/third_login/:username` endpoint briefly provided access to a device-management interface; researchers also documented other panel endpoints.
The article lists associated infrastructure and file hashes as indicators of compromise and recommends reviewing device permissions, enabling security protections, and checking historical logs and forensic artifacts.

Article Details

Attack Vectors: LightSpy has been deployed in targeted attacks using watering hole techniques and exploit-based delivery.
LightSpy's command structure includes collection of Facebook and Instagram database files; its plugins support surveillance functions including keylogging, audio recording, and video capture.
LightSpy operators use command-and-control servers and plugin-hosting infrastructure to manage deployments and deliver components.
Defensive Notes: Restrict app permissions and review sensitive-data access using Android Privacy Dashboard and iOS App Privacy Reports.
Enable device protections, including iOS Lockdown Mode and Android Enhanced Google Play Protect and exploit protection settings.
Examine historical system logs and forensic artifacts for the 2021-12-31 LightSpy core version and related components.

Indicators of compromise

Type	Indicator	Context
IPV4	`103[.]238[.]227[.]138`	Additional server referenced by LightSpy's plugin URL field and serving plugins.
IPV4	`149[.]104[.]18[.]251`	IP associated with LightSpy activity and hosting an admin panel.
IPV4	`149[.]104[.]18[.]80`	LightSpy command-and-control server; its command list and core metadata were analyzed in the article.
IPV4	`43[.]248[.]8[.]108`	IP associated with LightSpy activity and hosting an admin panel.
IPV4	`43[.]248[.]8[.]76`	Identified as a detected LightSpy command-and-control server.
IPV4	`45[.]125[.]34[.]126`	Previously reported LightSpy command-and-control server used for comparison of command lists.
MD5	`81d2bd4781e3753b508ff6d966dbf160`	MD5 hash reported for LightSpy core information returned with the 2021-12-31 deployment date.
SHA256	`0258edc8c3efe8b3d8ccfce790c9192994e54a81dded1c0e116093d638506a01`	SHA-256 hash of the LightSpy Windows plugin videom.dll.
SHA256	`10c43f9dfaf94777f89248720555d17ac275b21ca726291989672b34f3991bc3`	SHA-256 hash of the LightSpy Windows plugin audiox64m.dll.
SHA256	`1d9293814fa3ce62fa67c1cbb8661660ffe1caa848142ba7f58dbbb60bc491ba`	SHA-256 hash of the LightSpy Windows plugin Capx64m.dll.
SHA256	`250e2aefc5a31019da9afeb22b1c704c6fd4db2da1ff6b5a0be4c63d23a32090`	SHA-256 hash of the LightSpy Windows plugin KeyLogLib64m.dll.
SHA256	`29e090acf7aa1296fa5d22b0df92a830e7a58467f966dd0f78bd1560dc0bad45`	SHA-256 hash of the LightSpy Windows plugin usbx64m.dll.
SHA256	`2e86456358046e347e05dce6ef6e30af92560901c145b95329fecaf6e64bd898`	SHA-256 hash of the LightSpy Windows plugin audiom.dll.
SHA256	`7147672b45832714c8b3d075665345d0860e9ebb672c4b5cbbe17243270ca41d`	SHA-256 hash of the LightSpy Windows plugin Capm.dll.
SHA256	`72eff7f7f928f54db67d9b3aeee9a6c2b0af89edc0a71ce09715489ac7644a68`	SHA-256 hash of the LightSpy Windows plugin KeyLogLib32m.dll.
SHA256	`74ce9f196c930c50811e4640283779ddd971e6a5ad6771c0577a80147c12bd35`	SHA-256 hash of the LightSpy Windows plugin usbm.dll.
SHA256	`7dbc26526fa32e1c91767d8b18abd3f4367f1b55b0f9ccf338fe5b9f74a36e48`	SHA-256 hash of the LightSpy Windows plugin srvx64m.dll.
SHA256	`890712c46e6629a59d1d82840256530f1cd3f1eda5c1e7f7f459ca786e120ba7`	SHA-256 hash of the LightSpy light.framework.zip artifact dated 2021-12-31.
SHA256	`98a5275997acab23c26165980f221eaf2aab90b779af162c06e8823b4d19c7a3`	SHA-256 hash of the LightSpy Windows plugin Terminalx86m.dll.
SHA256	`9da5c381c28e0b2c0c0ff9a6ffcd9208f060537c3b6c1a086abe2903e85f6fdd`	SHA-256 hash listed for a LightSpy host artifact, bbbb.jar.
SHA256	`9e4e2c92037f43441376685af7f30c6df602ed9706715073e696a6a178a4b5d7`	SHA-256 hash of the LightSpy light.framework.zip artifact dated 2020-12-21.
SHA256	`aee8ca6bcfff02ae0f931b76f48e39576477af289385cbcde27d3ac3e7fae35e`	SHA-256 hash of the LightSpy Windows plugin videox64m.dll.
SHA256	`bd6ec04d41a5da66d23533e586c939eece483e9b105bd378053e6073df50ba99`	SHA-256 hash listed for a LightSpy host artifact, smallmload.jar.
SHA256	`e7b9e5e3bd6f72c39ef687ae59b2380815e827ea479ad142f278f295d706c5ec`	SHA-256 hash of the LightSpy Windows plugin srvm.dll.
SHA256	`f05b8387f808a598338ce2258014b2c259a4297a5593779e46029b3c5539ea4e`	SHA-256 hash of the LightSpy Windows plugin vxx86m.dll.
URL	`hxxp[:]//149[.]104[.]18[.]80:30000/963852741/ios/version[.]json`	LightSpy server endpoint returning core metadata.