LightSpy spyware linked to Chinese firm targets users in 13 countries

Researchers have traced a recent wave of malicious cyber activity to a Chinese company after an operator of the spyware was identified through a seemingly ordinary KFC order. The order, placed with the fast‑food chain, used the operator’s real name and office address, providing investigators with a concrete point of contact that linked the activity to the firm.

The spyware in question, which has been used to target corporate and government communications, was found to be deployed by the identified operator in a series of recent attacks. By cross‑referencing the KFC order details with internal company records and digital footprints, security analysts were able to confirm the operator’s affiliation with the Chinese entity, thereby closing a key gap in the attribution chain.

The findings highlight how seemingly unrelated commercial transactions can serve as forensic breadcrumbs in cyber investigations. Authorities will continue to monitor the company’s operations and the broader threat landscape as part of ongoing efforts to mitigate the impact of state‑backed cyber espionage.