LightSpy: APT41 Deploys Advanced DeepData Framework In Targeted Southern Asia Espionage Campaign

Summary

In April 2024, BlackBerry identified a significant evolution in the LightSpy malware campaign, demonstrating enhanced capabilities and advanced data theft mechanisms. The threat actor behind LightSpy, who we believe with a high level of confidence is associated with Chinese cyber-espionage group APT41, has now expanded their toolset with the introduction of DeepData, a modular Windows-based surveillance framework that significantly broadens their espionage capabilities.

Threat Overview

•  A new modular malware framework (DeepData v3.2.1228)
• 12 specialized plugins for comprehensive data theft
• Enhanced cross-platform surveillance capabilities
• Sophisticated command-and-control infrastructure
• Strategic targeting of communications platforms

Critical Capabilities

Our new finding demonstrates extended depth and breadth in data collection:

Communication Surveillance:

• Unauthorized infiltration of major messaging platforms (WhatsApp, Telegram, Signal, WeChat)
• Email monitoring (Outlook)
• Corporate communication tools (DingDing, Feishu)

Credential Theft:

• Browser credentials and history
• Application passwords
• Network authentication data
• Password manager targeting (KeePass)

System Intelligence:

• Detailed system information collection
• Network configuration harvesting
• installed software inventory
• Audio recording capabilities

What is LightSpy Spyware?

LightSpy is an advanced espionage tool that was discovered in early 2020. It is a sophisticated, modular, surveillance-oriented toolkit for stealing sensitive information from victims, focusing on the Asia-Pacific region.

Its modular structure utilizes multiple plugins to track the victim. Each plugin is responsible for a different functionality aspect, such as access to the microphone, browser, or geolocation. The plugins are also designed to extract information about the device and files stored on it, including data from private messaging apps such as Telegram and WeChat.

Who is APT41?

APT41 (also known as Double Dragon) is a high-profile and highly prolific cyber-espionage group with alleged ties to the Chinese Ministry of State Security (MSS). First seen in 2012 attacking developers working in the video-game industry, the group soon expanded its reach to target high-tech firms, including media. In more recent years, the group’s digital tendrils have extended from intelligence gathering into further areas of government interest, including healthcare, education, telecommunications, and technology.

Technical Analysis

During our ongoing investigation into LightSpy and the associated advanced Android surveillance spyware WyrmSpy (also attributed to APT41), BlackBerry’s cyber threat intelligence team discovered an interesting file — deepdata.zip — being hosted by APT41’s C2.  

This file contained an additional four files, shown below in Figure 1:

Figure 1: Deepdata.zip contents.

Localupload.exe is a simple program that allows the user to upload a directory of files to a remote host.

Figure 2: localupload.exe usage.

Data.dll decrypts mod.dat and loads an espionage tool we have named DeepData, due to the file name given to it by the threat actor. DeepData has a similar layout to its related malware/spyware, LightSpy; a core module, frame.exe in this case, and many plugins.

Data.dll is has been observed looking for the following DLL files. Of these, 11 are listed as plugins by the C2 API:

• appdata.dll - plugin
• Audio.dll - plugin
• ChatIndexDB.dll - plugin
• ffmpeg.dll
• frame.dll
• iumdll.dll
• OutlookX32.dll - plugin
• Pass.dll - plugin
• ProductList.dll - plugin
• SocialSoft.dll - plugin
• SystemInfo.dll - plugin
• Tdm.dll - plugin
• Telegram.dll
• ucrtbase.enclave.dll
• WebBrowser.dll - plugin
• wifiList.dll - plugin

A handy readme.txt file included with DeepData demonstrates use of the stealer with manual execution, via the file rundll32.exe. The C2 address is also specified as a command line argument, as are the requested plugins to be run or data to extract. The implication of this execution method is that it must be done manually, sans a script or some other bundling distribution.

As such, we currently believe that this tool is run by the actor post exploitation.  

Detailed Technical Analysis:

DeepData Core

DeepData (conveniently for us) comes with a readme.txt:

Figure 3: Readme.txt for DeepData.

Many of the plugin program database (PDB) strings imply that this is version 2 of DeepData:

Figure 4: Plugin PDB strings.

Meanwhile, strings in frame.exe, decrypted from mod.dat, imply that the current version number is 3.2.1228.

Figure 5: DeepData version string showing current version number.
 

DeepData has support for a wide range of Windows versions. To deliver the correctly compiled plugin version, the following Windows versions are checked:

Figure 6: DeepData’s supported Windows versions.

Plugins

Figure 7. DeepData plugins overview.

The plugin files all have a similar export functionality. All plugins contain exports for their version, name, command ID, and command execution.

Figure 8: DeepData plugin exports.

Appdata Plugin

(*The Chinese characters in the PDB Path shown above roughly translate as “secret.”)

The appdata plugin contains multiple binaries in its resource section which are used for collecting data from instant messaging clients. The plugin attempts to access applications such as:

• WxWorks – A real-time operating system (RTOS) used by developers, designed for use in embedded systems.
• FeiShu – An enterprise collaboration platform developed by ByteDance, a Chinese Internet technology company.
• Signal – an open-source, encrypted messaging service for instant messaging, voice calls, and video calls, based in the U.S..
• WhatsApp – An instant messaging and voice-over-IP (VoIP) service owned by U.S.-based technology conglomerate Meta.

This application technically copies the functionality of the ChatIndexedDb.dll plugin in many ways. The difference is that it tries to access more applications. Perhaps the threat actor, having extended the functionality of this plugin appdata.dll, decided to use it in an attempt to access more applications, since ChatIndexedDb.dll targets only two apps.

We are basing this hypothesis on the fact that ChatIndexedDb.dll was compiled in October 2023, when the appdata.dll was built in early January 2024.

The appdata.dll plugin contains two executable libraries: WhatsApp.dll, and Signal.dll. These libraries will be launched when the plugin is running. WhatsApp.dll is essentially a copy of the library included in ChatIndexedDb.dll.

Figure 9: Code that unloads data from different messengers.

Appdata also contains X509 certificates for Windows Phone.

Figure 10: X509 Certificates in appdata.dll.

SystemInfo Plugin

This plugin (SystemInfo.dll) is designed to collect information on the user's system. It can collect the following information about a user and then send it back to a server that is controlled by the threat actor:

• Information about the processes running on the system, including paths to the executable files running in the system.
• Data about user accounts in the system.
• Network connection information including active port numbers.
• Information about running services on the system.
• List of drivers installed on the system, including their version and developer name.

wifiList Plugin

This plugin (wifiList.dll) is designed to collect information about wireless networks to which the user's device is connected, and save it in the file "WifiList.json." It also collects the list of keys to connect to wireless networks to which the user's device is connected, and saves them in the file "wifiKey.json." The plugin also collects the list of available networks for the victim's device.

After collecting all of this information, the plugin sends these two files to the threat actor’s server.

WebBrowser Plugin

This plugin (WebBrowser.dll) collects sensitive user information such as cookies, browsing history, passwords, and autocomplete data from popular browsers (Chrome, Firefox, Edge, Opera). It interacts with local browser databases, retrieving data via SQL queries and standard file paths, and processes it by applying cryptographic algorithms for decoding and hashing. At the same time, the plugin also contains error-handling modules to ensure stable operation.

Pass Plugin

This plugin (Pass.dll) attempts to collect account information as well as passwords from the following applications:

• BaiduNetDisk – A cloud storage service provided by Baidu, Inc., headquartered in Beijing.
• QQ – An instant messaging software service and web portal developed by the Chinese technology company Tencent.
• FoxMail – A freeware email client also developed by Tencent.
• MailMaster – An AI-powered email assistant.
• OneDrive – A file-hosting service operated by Microsoft.

This plugin also contains libraries of the "KeeFarce" project, which allows the unauthorized extraction of KeePass 2.x password database information from memory. The libraries are:

• KeeFarce.dll
• Bootstrap.dll
  

Using these libraries, the plugin attempts to extract passwords and other information from the KeePass application installed on the victim's device. The plugin then sends all collected data to a remote server controlled by the threat actor.  

OutlookX32 Plugin

This plugin (OutlookX32.dll) is designed to steal information from Microsoft’s Outlook application. The plugin attempts to access the following information:

• User emails
• Mail folders in the Outlook client
• User's contact list

ProductList Plugin

This plugin is designed to collect information about installed applications on the system. It can collect the applications' names and installation paths and transmit them to a server controlled by the threat actor.

SocialSoft Plugin

This plugin (SocialSoft.dll) is designed to allow unauthorized access to the following applications:

• WeChat – A Chinese instant messaging, social media, and mobile payment app developed by Tencent.
• DingDing – One of the largest mobile enterprise communication and collaboration apps in China, with over 100 million users.
• Telegram – A cloud-based, cross-platform, social media and instant messaging service.
• Feishu – An enterprise collaboration platform developed by ByteDance, a Chinese Internet technology company.
• QQ – An instant messaging software service and web portal developed by the Chinese technology company Tencent.
• Skype – An IP-based videotelephony, videoconferencing and voice call service developed by Microsoft.

The plugin attempts to access messages and data stored in application directories. If message theft succeeds, the plugin packages the messages and sends them to a server controlled by the threat actor.

Audio Plugin

This plugin (Audio.dll) is designed to record the audio environment with a microphone on the target system device. At runtime, the plugin extracts another executable library (audio.core.dll) from its body that is packaged by the UPX packer.

 Unpacked sample audio.core.dll:

This plugin uses open-source libraries called FFmpeg 4.3.5 to record audio. The plugin records audio in Advanced audio Encoding (.aac) format and saves the recording to a %temp% folder. AAC is an audio coding standard for lossy digital audio compression. It achieves higher sound quality than MP3 at the same bit rate.

Along with the command to record audio, the plugin will receive the audio recording duration in seconds. After the recording is complete, the audio file will be transferred to a server controlled by the threat actor.

Figure 11: The code of the plugin that starts the sound recording.

ChatIndexedDb Plugin

This plugin is used by a threat actor to monitor the WhatsApp and Zalo apps installed on Windows. Zalo is a mobile messaging app that is most popular in Vietnam, with an 82% usage rate in 2024, and 77.6 million monthly active users. The plugin will attempt to copy all application data from these apps. It also monitors the data shared by the user in private chats with their other contacts.

It additionally contains the WhatsApp.dll library in its body, which is specially designed to steal data and messages from the WhatsApp application. If the data theft is successful, the plugin packs the data and sends it to a server controlled by the threat actor.

WhatsApp.dll Library

Figure 12: A plugin that uploads WhatsApp data.                                               

Tdm Plugin

This plugin downloads a library called Telegram.dll and injects it into the address space of the “Telegram for Windows” application. This plugin attempts to copy all the information in the user's chats, including contacts, messages, images, audio, and video. If the copying is successful, the plugin sends the data to a server controlled by the threat actor.

Figure 13: The code that injects the Telegram.dll library into the Telegram for Widows process.

Network Infrastructure

The front-end application programming interface (API) of APT41’s LightSpy implant has an endpoint called cmd_list at the uri /ujmfanncy76211/front_api/cmd_list. This dumps a json blob containing all of the supported commands for a given C2 deployment.

Below is a list of all commands with Windows in the supported operating system (OS) values. It is noteworthy that “Windows Keylogger” is new as of the middle of October 2024.

Researchers at Hunt.io published a great writeup on tracking LightSpy and WyrmSpy C2. Internet intelligence-based threat hunting platform Censys even implemented resource identifiers for both LightSpy and WyrmSpy.

A new SSL certificate is being used on some of the C2 servers: C=CN, ST=BJ, L=BJ, O=Company, emailAddress=admin[at]zb.com.

At the time of writing, four of the 10 systems online using this certificate are LightSpy C2s. Many of these C2s have a login page at the uri /qazxswedcvfr/login. Both LightSpy and WyrmSpy C2s have been seen hosting this certificate and login page. The favicon indicates use of the open-source Vue JavaScript framework, which is in line with previous web interfaces created for or by this developer.

Figure 14. Page to login to the C2 control panel.

DeepData is hosted on C2 utilizing this certificate on port 28992 for the plugin server, and port 28993 for command-and-control.

Figure 15: Network locations from deepdata’s config.json.

Another new SSL certificate is shared by a single WyrmSpy C2:

Subject: O=https Project, CN=httpsServer
            Issuer: O=https Project Certificate Authority

This certificate is only utilized by three servers also hosted on the same ASN as many of the LightSpy and WyrmSpy C2s.

Threat Actor Analysis: LightSpy Timeline Context

Pre-2022

• Initial development of LightSpy malware
• Early targeting and deployment phases
• Establishment of basic infrastructure

2022

August 19, 2022

• Compilation of wifiList.dll plugin
• Initial development of network reconnaissance capabilities

2023

July 2023

• July 8: Compilation of Audio.dll (7:43:13 UTC)
• July 8: Compilation of audio.core.dll with FFmpeg 4.3.5 integration (8:51:34 UTC)

October 2023

• October 13: Compilation of SocialSoft.dll (11:35:41 UTC)
  • Introduction of social media monitoring capabilities
  • Unauthorized infiltration of WeChat, DingDing, Telegram, Feishu, QQ, and Skype
• October 20: Compilation of ProductList.dll (13:24:30 UTC)
  • Application enumeration functionality added
• October 23: Initial WhatsApp.dll compilation (03:14:00 UTC)
• October 26: Multiple component updates
  • SystemInfo.dll compilation (11:37:28 UTC)
  • ChatIndexedDb.dll compilation (10:23:30 UTC)
  • Enhanced messaging platform surveillance capabilities
• October 27: Compilation of Pass.dll (08:55:22 UTC)
  • Integration of password stealing capabilities
  • Implementation of KeePass targeting functionality

November 2023

• November 16: Compilation of WebBrowser.dll (09:03:55 UTC)
  • Browser credential theft capabilities added

December 2023

• December 5: Compilation of Tdm.dll (06:58:05 UTC)
  • Telegram-specific monitoring capabilities introduced

2024

January 2024

• January 4: Compilation of Signal.dll (02:49:18 UTC)
  • Signal messenger monitoring capability added
• January 6: Updated WhatsApp.dll compilation (07:52:25 UTC)
• January 15: Compilation of appdata.dll (11:26:12 UTC)
  • Enhanced data collection capabilities
  • Integration with multiple messaging platforms

February 2024

• February 27: Multiple significant updates
  • Compilation of Frame.exe (02:04:24 UTC)
  • Compilation of OutlookX32.dll (02:04:24 UTC)
  • Implementation of email surveillance capabilities

March 2024

• March 19: Compilation of Data.dll (03:47:44 UTC)
  • Core component of DeepData framework

April 2024

• Mid-October: Introduction of new "Windows Keylogger" functionality
  • Identification of new SSL certificates in use
  • Discovery of expanded C2 infrastructure
     

Infrastructure Evolution

Current Active C2 Infrastructure

• 22 identified C2 servers across multiple ASNs
• Implementation of new SSL certificates:
  • Certificate with admin[at]zb.com
  • Certificate from "https Project"
  • Deployment of Vue Javascript-based control panel
  • Implementation of specialized login pages at /qazxswedcvfr/login
     

Key Observations

Development Acceleration

• Intense development period from October 2023 to April 2024
• Significant expansion of capabilities and modules
• Regular updates and improvements to core components

Capability Evolution

• Progressive addition of new messaging platform support
• Enhanced data collection capabilities
• Improved stealth and persistence mechanisms

Infrastructure Development

• Continuous expansion of C2 infrastructure
• Implementation of new security certificates
• Enhanced operational security measures

Operational Sophistication

• Module-based development approach
• Regular updates to core components
• Strategic timing of capability rollouts

Conclusions

Our latest findings indicate that the threat actor behind DeepData has a clear focus on long-term intelligence gathering. Since their initial development of the LightSpy spyware implant in 2022, the attacker has been persistently and methodically working on the strategic targeting of communication platforms, with the emphasis on stealth and persistent access.

The sophisticated modular architecture, comprehensive surveillance capabilities, and robust infrastructure detailed in this report suggest a well-resourced and technically proficient threat actor with strategic objectives.

Organizations of all sizes, particularly those in targeted regions, should treat this threat as a high priority and implement comprehensive defensive measures. The continued evolution of tools like DeepData indicates a persistent threat that will likely expand in both capability and scope as time goes on.

Victimology

Based on the victims that the threat actor hiding behind LightSpy has targeted in the past, and also based on the applications DeepData attempts to access, we believe that the intended targets are located in Southeast Asia, and, with a medium degree of probability, can be associated with political activists, politicians and journalists.

Countermeasures

BlackBerry customers are protected against the DeepData IoCs listed in this blog post by endpoint protection solutions such as CylanceENDPOINT™. CylanceENDPOINT leverages advanced AI to detect threats before they cause damage, minimizing business disruptions and the costs incurred during a ransomware attack.

Recommendations for Defenders

1. Block identified command-and-control infrastructure.
   
2. Monitor network and devices for unauthorized audio recording activities.
   
3. Use secure communications platforms for business sensitive data.
   
4. Deploy detection rules for DeepData components.
   
5. Review logs for indicators of compromise (IoCs).
6. Assess exposure of sensitive communication channels.
    

APPENDIX 1 – IoCs (Indicators of Compromise)

APPENDIX 2 – Applied Countermeasures

Yara Rules

Suricata Rules

Django Debugging Dump From DeepData API Endpoint

Related Reading

• LightSpy Returns: Renewed Espionage Campaign Targets Southern Asia, Possibly India
• Lynx on the Prowl: Targeting SMBs with Double-Extortion Tactics
• Drawing a Dragon: Connecting the Dots to Find APT41