WyrmSpy

Reported Context (4)

We didn’t forget about AndroidControl, also known as WyrmSpy, LightSpy’s reported successor. In the next section, we will cover the certificates behind both LightSpy and AndroidControl in detail. TLS Certificates Reveal LightSpy and WyrmSpy Infrastructure Patterns
we'll only be focusing on the macOS implant. For more information of the Android version (also known as WyrmSpy), please see this report by the ThreatFabric team. Huntress Uncovers LightSpy macOS Variant and Details Its Multi-Stage Implant
In July 2023 our colleagues from Lookout posted a report about two families of Spyware: DragonEgg and WyrmSpy, researchers attributed both families to the Chinese APT-41 group. Researchers Link Android DragonEgg Spyware to LightSpy and Detail Its Data-Theft Capabilities
5. Chinese APT41 Hackers Target Mobile Devices with New WyrmSpy and DragonEgg Spyware – The Hacker News July Threat Intelligence Roundup Covers Malware Campaigns and Data Breaches

Malware (6)

People (2)

Threat Actors (7)

MITRE ATT&CK (17)

Vendors (3)

Products (12)

Tools (2)

Industries (1)

Countries (10)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.