TLS Certificates Reveal LightSpy and WyrmSpy Infrastructure Patterns
Summary
Hunt IO analyzes LightSpy and WyrmSpy infrastructure, showing how TLS certificate patterns, ports, hosting, and server details can help researchers identify and track related servers.
Key points
- LightSpy is a surveillance framework targeting iOS, Android, macOS, and Windows; the article describes its infrastructure as concentrated mainly in China and Hong Kong.
- LightSpy commonly uses high ports, especially 51200 and 53501, while WyrmSpy commonly uses ports 443 and 3389.
- Both frameworks use Nginx; the article reports versions 1.14.0 for LightSpy and 1.10.3 for WyrmSpy.
- Researchers can use distinct TLS certificates to link servers even when operators change control-panel pages or titles.
- Similar certificate structures may indicate a shared methodology or toolkit, but the article presents this as a potential correlation rather than proof of common operators.
- Hunt IO reports finding a LightSpy certificate on 103.43.17_99 at port 54600; the server also presented a ZeroSSL certificate for yycclouds[.]com on port 443.
- The article cautions that probing suspected malicious infrastructure can alert operators and expose investigators to risk.
Article Details
- Attack Vectors
- LightSpy is described as spyware targeting iOS, Android, macOS, and Windows devices and exfiltrating sensitive data, including files, screenshots, location information, voice recordings, and payment information.
- LightSpy and WyrmSpy use TLS certificates and command-and-control servers; the article describes certificate characteristics and hosting patterns as ways to identify related infrastructure.
- Defensive Notes
- Use TLS certificate characteristics and hosting patterns to identify and correlate related infrastructure, rather than relying solely on changeable web-page titles.
- Periodically reassess identified servers because infrastructure and certificates can change or be transferred.
- Exercise discretion when probing suspected malicious infrastructure; the article warns that direct interaction may alert operators or expose the probing network.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | yycclouds[.]com | Domain associated with a certificate on the LightSpy C2 server 103.43.17_99. |
| IPV4 | 8[.]219[.]55[.]216 | Listed as sharing a certificate with WyrmSpy. |
Malware
LightSpyIn this post, we'll detail the infrastructure of the LightSpy spyware framework and highlight the unique TLS certificates that have been instrumental in identifying its servers.WyrmSpyWe didn’t forget about AndroidControl, also known as WyrmSpy, LightSpy’s reported successor. In the next section, we will cover the certificates behind both LightSpy and AndroidControl in detail.
Vendors
ChinaNetis located in China and Hong Kong, with a single server identified in Japan. Topway Global Limited and ChinaNet comprise most of the servers hosting the certificates associated with the framework. Based on ourTopway Global Limitedinfrastructure is located in China and Hong Kong, with a single server identified in Japan. Topway Global Limited and ChinaNet comprise most of the servers hosting the certificates associated with the framework.
Products
Countries
ChinaAccording to our scans, most of LightSpy's infrastructure is located in China and Hong Kong, with a single server identified in Japan. Topway Global Limited and ChinaNet comprise most of the servers hosting theHong KongAccording to our scans, most of LightSpy's infrastructure is located in China and Hong Kong, with a single server identified in Japan. Topway Global Limited and ChinaNet comprise most of the servers hosting theJapanmost of LightSpy's infrastructure is located in China and Hong Kong, with a single server identified in Japan. Topway Global Limited and ChinaNet comprise most of the servers hosting the certificates associated with