TwoSail Junk

  • First known sample

    2020
  • Discovery

    2020
  • Current status

    Active
  • Type

    APT
  • Targeted platforms

    Android , Linux , Windows , iOS
  • TOP targeted countries

    Hong Kong
  • Connected attacks

  • The way of propagation

    Exploits
  • Purpose/Functions

    Cyberespionage
  • Artefacts/Attribution

    Chinese-speaking

  • Description

    This APT group was seen using a watering hole attack to deploy a feature-rich implant known as LightSpy against users in Hong Kong in winter 2020. Potential victims are redirected to an exploit site via posts and replies on online messaging channels; the malicious implant contains backdoor malware. TwoSail Junk’s activity is potentially linked to the long-running APT group Spring Dragon.

    Additional information