Cybersecurity vendor Kaspersky discovered LianSpy in March 2024, utilizing Yandex Cloud for C2 communications. The spyware captures screencasts, harvests data, and disguises itself as Alipay or a system service.
LianSpy, once active, runs as a system app with admin privileges or requests various permissions. It hides its icon, persists through reboots, captures data, updates configurations, and checks for specific conditions like network connectivity.
The spyware updates its configuration using Yandex Disk, searching for specific image files every 30 seconds. Variants can target instant messaging apps, specify network requirements, and control information gathering.
[
Collection
]
[
|
...
]