aol.pm

LightSpy

Software · ATTACK:mobile:S1185

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:S1185",
  "title": "LightSpy",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S1185",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--5b5d1e6c-e7de-4b46-ab8f-8556e8745927",
  "external_id": "S1185",
  "domain": "mobile",
  "created": "2025-01-03T20:41:46.276Z",
  "modified": "2025-04-15T18:40:23.781Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "MelikovBlackBerry LightSpy 2024",
      "url": "https://blogs.blackberry.com/en/2024/04/lightspy-returns-renewed-espionage-campaign-targets-southern-asia-possibly-india"
    }
  ]
}

Explicit source assertions (36)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0df1f5d1-f2fd-441e-b3ce-bcd64f5f5f50

LinkedIn Dmitry LightSpy 2025 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1544

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15706c6d-803b-4857-9fcb-ce9af2c9d73b

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1422.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15772932-8a5c-4616-9fea-b2bd1ecace4b

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18186ee9-0ae4-405c-bf73-4d9ca1689744

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Shoshin_Kaspersky LightSpy 2020 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1623

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22512e29-4524-45d3-88b7-d9ca764f7b3d

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1634.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ac32eb8-ff7e-468a-8bbd-f5af82e0102a

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Shoshin_Kaspersky LightSpy 2020 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1658

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f2ae4a3-1ed9-4c90-86dc-d12c3a860349

Shoshin_Kaspersky LightSpy 2020

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c4ea7a5-251c-4d10-a724-f4a247f44637

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1532

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--494ece43-ebba-4519-86be-cd5c4d4dd337

LinkedIn Dmitry LightSpy 2025 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1424

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--526099a3-132d-430f-9559-fc067e39b227

LinkedIn Dmitry LightSpy 2025 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5340f466-abf0-4bb9-a7e9-44694014561d

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Shoshin_Kaspersky LightSpy 2020 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56816b86-3c80-429b-8360-7b4e77538c97

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Threatfabric LightSpy 2023

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5976af4f-2fd4-46a0-baab-a4ae69e98bc1

LinkedIn Dmitry LightSpy 2025

ATTACK:mobile:G0096 → uses → ATTACK:mobile:S1185

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ceb24c4-f32d-4eca-ad91-aed9ef8d459b

MelikovBlackBerry LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1456

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e642c09-751c-43d8-9b99-aabb1703cad7

LinkedIn Dmitry LightSpy 2025 · FirshSecureList LightSpy 2020 · Shoshin_Kaspersky LightSpy 2020 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c67e8eb-4967-4858-8bfe-bb68c3f30cfd

LinkedIn Dmitry LightSpy 2025

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1509

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--821db003-f7ad-4e28-b07d-2e3fc4f208a7

Threatfabric LightSpy 2023

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--841dcc87-1c22-4775-abe8-606aa6a48bf7

LinkedIn Dmitry LightSpy 2025 · FirshSecureList LightSpy 2020 · MelikovBlackBerry LightSpy 2024 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1660

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90e76d57-90b2-4d5d-8928-f6e6f5414bd4

FirshSecureList LightSpy 2020 · Shoshin_Kaspersky LightSpy 2020

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1421

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a111958f-bb98-48c1-ad44-bf55fad232e9

FirshSecureList LightSpy 2020 · MelikovBlackBerry LightSpy 2024 · Shoshin_Kaspersky LightSpy 2020 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1642

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a26a09cd-1718-403f-99f3-fdb127ac3599

LinkedIn Dmitry LightSpy 2025

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1631

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a394e5e5-1d98-4e08-ba29-866cf7ff9a62

LinkedIn Dmitry LightSpy 2025

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa65aa77-ce74-49fd-8295-c5b7395a703c

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Shoshin_Kaspersky LightSpy 2020 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1423

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b336b44d-1810-4672-8e51-a63e91681907

LinkedIn Dmitry LightSpy 2025 · Shoshin_Kaspersky LightSpy 2020 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1430

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c052da1e-4a1e-48bb-9b8d-b68839d4347e

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Shoshin_Kaspersky LightSpy 2020 · Threatfabric LightSpy 2023

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd1ad516-d953-40cb-b0d5-b384ceb410f2

LinkedIn Dmitry LightSpy 2025 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dea15947-3a93-4ef6-94c4-ddd8b5bf4db5

LinkedIn Dmitry LightSpy 2025 · FirshSecureList LightSpy 2020 · MelikovBlackBerry LightSpy 2024 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e4451543-136b-4fe2-a8e2-d005db705aa2

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e515259a-63b1-4ac8-bbec-4b0103d0a79a

LinkedIn Dmitry LightSpy 2025 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e682fd05-a55e-447c-9de1-788cf061ba70

LinkedIn Dmitry LightSpy 2025 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ec30f169-9cf3-45c3-9a02-cda318107ba9

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1208f2a-f2e2-48bd-8fdc-d56b9442f185

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1575

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1c06c38-0f58-4789-9758-1e321394e03f

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1655

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f78e0c04-1946-4a0f-9ecb-324373f97e8a

LinkedIn Dmitry LightSpy 2025 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1662

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fe1e9775-0923-4b8f-87d9-976fd1d3910a

LinkedIn Dmitry LightSpy 2025 · Threatfabric LightSpy 2024

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1398

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fed0de7b-509f-445d-90b9-4b507214298b

Threatfabric LightSpy 2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.