LightSpy iOS Spyware Uses Public Exploits and Adds Destructive Plugins
Summary
ThreatFabric analyzed LightSpy for iOS, finding public exploits, 17–28 plugins and destructive features that can impair or prevent booting. Researchers identified five C2 servers and logs indicating eight infected iOS devices.
Key points
- LightSpy used CVE-2020-9802 for initial access and CVE-2020-3837 for privilege escalation; the report says the exploits targeted iOS versions up to 13.3.
- The analyzed Core was version 7.9.0. Depending on C2 configuration, the implant could download 17–28 plugins, up from 12 in the previously documented version.
- Seven plugins had destructive functions, including wiping data, deleting system-related components, freezing a device, or preventing it from booting.
- The implant used a jailbreak-based infection chain, then installed a Core that communicates with C2 servers and manages plugins, commands, logs, and collected data.
- Researchers identified five active C2 servers and found deployment dates as late as October 26, 2022; the exploits used for delivery had been patched in 2020.
- A poorly secured control server exposed logs for 15 unique victims, including eight iOS devices. Researchers assessed only one device as appearing to belong to a real victim; the others may have been test devices.
Article Details
- Attack Vectors
- A WebKit exploit, CVE-2020-9802, was delivered through exploit URLs hosted on LightSpy infrastructure; the report says victims had to visit a page containing the exploit.
- The implant used CVE-2020-3837 for privilege escalation, alongside the jailbreak kit and a “time_waste” exploit.
- FrameworkLoader downloaded the LightSpy Core and plugins from configured C2 infrastructure.
- The plugins could collect device data and communications, record audio and video, capture screens, and perform destructive actions such as disabling Wi-Fi or preventing the device from booting.
- Defensive Notes
- Keep iOS updated: the report says CVE-2020-9802 was fixed in iOS 13.5 and the CVE-2020-9870 and CVE-2020-9910 mitigation bypasses were fixed in iOS 13.6.
- The report recommends regular device reboots as a way to limit information exfiltration by the rootless jailbreak; it notes that rebooting does not prevent reinfection.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 103[.]27[.]109[.]217 | C2 server and payload-delivery host associated with the LightSpy iOS campaign. |
| IPV4 | 103[.]27[.]109[.]28 | Identified as a LightSpy iOS C2 server. |
| IPV4 | 103[.]43[.]17[.]99 | Identified as a LightSpy iOS C2 server. |
| IPV4 | 222[.]219[.]183[.]84 | Identified as a LightSpy iOS C2 server; the report also found a working administration panel on this host. |
| IPV4 | 43[.]248[.]136[.]110 | Identified as a LightSpy iOS C2 server. |
| MD5 | 4bbd20358202e618843ca23b90906122 | MD5 integrity hash listed for LightSpy Core version 7.7.1. |
| MD5 | 53acd56ca69a04e13e32f7787a021bb5 | MD5 of a previously reported LightSpy ircloader-stage file. |
| MD5 | 66f0afaef75f871645458f672a21ae4d | MD5 integrity hash listed for LightSpy Core version 7.9.0. |
| MD5 | 6cc277a36e18725c88b6b48324be6497 | MD5 integrity hash listed for LightSpy Core version 7.9.1. |
| SHA256 | 22490eb6347283328220f33df497e67148253e29175d97446f4fdc7b7d5caef8 | SHA-256 of the LightSpy jailbreak-stage file aaa13. |
| SHA256 | 3cf03ce0ed2b9840d8d9ed467d105df177dac2818101964c97ba9a281a180558 | SHA-256 of the LightSpy initial-stage file 20012001330.png. |
| SHA256 | 5cdcb1cacb27c539494e02aba7e264e0959741184215c69da66a11a5815c5025 | SHA-256 of the LightSpy initial-stage file 20012001241.png. |
| SHA256 | 798c1bb247eb2bb61d2c4c9a946e067748dad20659c6d9321a352956ace79748 | SHA-256 of the LightSpy FrameworkLoader file bb. |
| SHA256 | 978218c1f6e043c80868d2da3e0365d0e4dcc74b8e4567a69081d2f313951d8f | SHA-256 of a LightSpy Core archive, light.framework.zip. |
| SHA256 | a4fafd63213a40447841e853f341ca3a0afd08adfcfb630c8f34b5fabfac0462 | SHA-256 of zt.dylib, a library used by LightSpy’s destructive Bootdestroy plugin. |
| URL | hxxp[:]//103[.]27[.]109[.]217:52202/963852741/csm/tem2/0914-3/aaa13 | Jailbreak-kit file downloaded from LightSpy infrastructure as part of the infection chain. |
| URL | hxxp[:]//103[.]27[.]109[.]217:52202/963852741/csm/tem2/0914-3/b[.]plist | LightSpy startup plist downloaded from the C2 host to start FrameworkLoader during system boot. |
| URL | hxxp[:]//103[.]27[.]109[.]217:52202/963852741/csm/tem2/0914-3/bb | Next-stage LightSpy payload, identified as FrameworkLoader, downloaded from the C2 host. |
| URL | hxxp[:]//103[.]27[.]109[.]217:52202/963852741/csm/tem2/0914-3/cc | Launchctl binary downloaded from LightSpy infrastructure for persistence. |
| URL | hxxp[:]//103[.]27[.]109[.]217:52202/963852741/csm/tem2/0914-3/eee | Testing executable downloaded from LightSpy infrastructure to check whether the jailbreak succeeded. |
| URL | hxxp[:]//103[.]27[.]109[.]217:52202/963852741/ios/ios120-122/index[.]html | Exploit URL on LightSpy infrastructure used to target older iOS versions. |
| URL | hxxp[:]//103[.]27[.]109[.]217:52202/963852741/ios/IOS123-133/index[.]html | Exploit URL on LightSpy infrastructure used to target iOS versions 13 and above. |
MITRE ATT&CK
T1005 · Data from Local SystemPlugins collected local contacts, call history, SMS, mail and messenger data, files, and other device information.T1041 · Exfiltration Over C2 ChannelThe Core sent plugin results, logs, and other collected data to the control server.T1055 · Process InjectionA package helper attempted to inject libcynject.dylib into the SpringBoard process.T1059.004 · Unix ShellThe Bootdestroy plugin spawned a shell to execute /usr/sbin/nvram auto-boot=false; another plugin could execute shell commands.T1068 · Exploitation for Privilege EscalationThe infection chain used CVE-2020-3837 and a jailbreak kit to escalate privileges.T1071.001 · Web ProtocolsThe Core communicated with its C2 over WebSocket, and the PushMessage plugin also used a WebSocket library.T1082 · System Information DiscoveryThe Core sent extensive fingerprint information about infected devices to the control server.T1105 · Ingress Tool TransferThe implant downloaded jailbreak files, FrameworkLoader, the Core, plugins, and resources from its servers.T1113 · Screen CaptureThe Screen_cap plugin captured screenshots.T1123 · Audio CaptureLightSpy included plugins for environmental and call audio recording.T1125 · Video CaptureThe shared library used by recording plugins contained video-recording functions.T1189 · Drive-by CompromiseThe report says victims had to visit a page containing the exploit; the exploit URL served the initial WebKit attack.T1203 · Exploitation for Client ExecutionLightSpy used the CVE-2020-9802 WebKit exploit for initial access to iOS devices.T1499.004 · Application or System ExploitationDestructive plugins could freeze the device, disable Wi-Fi, or prevent the device from booting.T1547.011 · Plist ModificationThe downloaded launchctl binary and plist were used to arrange for FrameworkLoader to start during system boot.
CVE
CVE-2020-3837They utilized the publicly available Safari exploit CVE-2020-9802 for initial access and CVE-2020-3837 for privilege escalation.CVE-2020-9802They utilized the publicly available Safari exploit CVE-2020-9802 for initial access and CVE-2020-3837 for privilege escalation.CVE-2020-9870This time it was CVE-2020-9802, which was fixed in iOS 13.5, while two of the mitigation bypasses, CVE-2020-9870 and CVE-2020-9910, were fixed in iOS 13.6.CVE-2020-9910This time it was CVE-2020-9802, which was fixed in iOS 13.5, while two of the mitigation bypasses, CVE-2020-9870 and CVE-2020-9910, were fixed in iOS 13.6.
Malware
Vendors
Products
iOSDuring that investigation, we discovered that the threat actor was using the same server for both macOS and iOS campaigns.Mail MasterThis plugin targets a specific mail client application which is called Mail Master by NetEase.WebKitThe threat actor followed the previously observed approach to gain access to the target device: a WebKit vulnerability was used as an initial attack vector.
Tools
jelbrekLibFrameworkLoader will call two functions: _inject and trustBin, both threat actors copied from the "jelbrek.m" file of the jelbrekLib GitHub project.OdysseyBoth amfidebilitate and jbexec are present inside other jailbreak toolkits, Odyssey and Taurine.TaurineBoth amfidebilitate and jbexec are present inside other jailbreak toolkits, Odyssey and Taurine.