LightSpy Spyware Now Targets 13 Countries And Routers

LightSpy, a spyware platform first identified years ago, has reportedly expanded into a broader commercial surveillance operation targeting victims in 13 countries and a wider range of devices, including routers.

TechCrunch reports that researchers at Arctic Wolf found LightSpy activity beyond mainland China, including across Europe and the United States. The spyware can target smartphones, Apple devices, Linux servers, Windows PCs and routers, with capabilities to steal location data, chats, recordings, passwords and screen captures. Researchers also said the malware can remotely wipe or destroy data on compromised devices.

The router detail is important. When spyware compromises a phone or laptop, the attacker sees that device. When it compromises a router, the attacker can potentially see traffic and connected devices across the network. That makes routers a valuable position for surveillance and lateral movement.

Arctic Wolf reportedly identified at least 117 servers tied to LightSpy infrastructure and said some compromised routers were associated with NATO member countries. The researchers also linked activity to a Chinese contractor after one operator allegedly used a LightSpy administrator panel while placing a food order with his real name and office address.

The story shows how spyware is moving beyond traditional state operations. LightSpy is described as having commercial features such as branding, billing and demos, which suggests a platform sold or operated for different customers. That is the wider risk: surveillance tooling is becoming productised.

This matters because spyware is no longer only a problem for dissidents, journalists or senior officials. The same market can eventually affect companies, activists, lawyers, telecoms, government agencies and ordinary users whose devices sit near more valuable targets. Once commercial spyware spreads, the victim category expands.

Africa should treat this as relevant, not distant. Governments, telecoms, civil-society organisations, banks and political groups across the continent rely on imported devices, routers and cloud services. If spyware platforms can target routers and mixed-device environments, weak patching and poor network visibility become serious risks.

We have covered related cyber-risk patterns recently, including Mirage Kitten malware targeting organisations in Africa and the Middle East and ad-tech data being weaponised for cyberattacks. LightSpy fits the same direction: attackers are using more precise tools, richer data and broader infrastructure.

For users, the basic advice remains practical. Keep devices and routers updated, replace unsupported routers, avoid installing configuration profiles or apps from unknown sources, and treat unusual device behaviour seriously. For organisations, router monitoring, endpoint detection, asset inventory and network segmentation matter more than ever.

The larger lesson is that surveillance is becoming industrialised. Once spyware has customer demos, infrastructure and support-like features, it behaves less like a one-off hacking tool and more like a business. That should worry regulators and security teams equally.