LightSpy: APT41 Deploys Advanced DeepData Framework In Targeted Southern Asia Espionage Campaign

Arctic Wolf Labs identified DeepData (v3.2.1228), a modular Windows espionage framework linked to the LightSpy campaign and attributed to APT41, featuring ~12 specialized plugins for credential and messaging-data theft, audio recording, system reconnaissance, and robust C2 infrastructure; the report provides detailed technical analysis, IOCs (file hashes, IPs, certificates), YARA/Suricata rules, a timeline of development, and defensive recommendations for detecting and mitigating this targeted surveillance campaign.