Threat reportMalwareTL-2026-0777
APT-C-60 Spear-Phishing Campaign Deploying SpyGlace Spyware (v3.1.12-3.1.14) via VHDX/LNK and Git (gcmd.exe) LOLBin Abuse
APT-C-60 Spear-Phishing Campaign Deploying SpyGlace Spyware (TL-2026-0777), also tracked as APT-C-60 SpyGlace 2025 Japan recruitment campaign, is a high-severity malware campaign, first published 2026-06-11. It is attributed to APT-C-60 (South Korea) with high confidence, affects Microsoft Windows, references 1 CVE (CVE-2024-7262), maps to 23 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 40 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 23MITRE ATT&CK
- Actors
- 1APT-C-60
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 40Indicators of compromise
Key facts for TL-2026-0777
- Threat ID
- TL-2026-0777
- Also known as
- APT-C-60 SpyGlace 2025 Japan recruitment campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- APT-C-60
- Attribution confidence
- HIGH
- Nation-state nexus
- South Korea
- Motivation
- ESPIONAGE
- Target sectors
- recruitment, human-resources, staffing, government, technology
- Target regions
- Japan, East Asia
- Detection rules
- 9
- Indicators of compromise
- 40
Malware and tooling in APT-C-60 Spear-Phishing Campaign Deploying SpyGlace Spyware
Malware and tooling: SpyGrace
How APT-C-60 Spear-Phishing Campaign Deploying SpyGlace Spyware works
APT-C-60, a South Korea-aligned espionage actor in the DarkHotel cluster, ran a June-August 2025 spear-phishing campaign against Japanese recruitment staff using job-seeker-themed emails with VHDX attachments. An embedded LNK abuses the legitimate Git binary (gcmd.exe) to run a dropper script, establishes COM-hijacking persistence, and deploys updated SpyGlace spyware (3.1.12-3.1.14). Payload distribution shifted from Bitbucket to GitHub and Statcounter is abused as a dead-drop resolver for C2.
JPCERT/CC (Yuma Masubuchi, published 2025-11-05) documents the continuation and evolution of APT-C-60 espionage activity against Japan observed between June and August 2025, targeting recruitment/HR staff with job-application lures. The intrusion chain begins with a spear-phishing email impersonating a job seeker that carries a malicious virtual hard disk image, "CV & Professional Experience.vhdx", directly as an attachment. When the victim mounts the VHDX and clicks the embedded shortcut "Resume.rtf.lnk", the LNK launches the legitimate, signed Git command binary gcmd.exe shipped inside the image (P:\LICENSES.LOG\mingw64\bin\gcmd.exe) and pipes the dropper script glog.txt into it: 'cd .\LICENSES.LOG\mingw64\bin && type glog.txt | gcmd.exe'. This Living-Off-the-Land abuse of a developer utility lets the actor proxy script execution through a trusted binary, bypassing many application-control and signature checks.
The dropper displays a decoy document, writes follow-on artifacts, and launches WebClassUser.dat (Downloader1), which achieves persistence through Component Object Model (COM) hijacking by writing the InProcServer32 value under HKCU\Software\Classes\CLSID\{566296fe-e0e8-475f-ba9c-a31ad31620b1}. Downloader1 retrieves Downloader2 (WebCacheR.tmp.dat), which in turn pulls a loader (datapages.txt) and the SpyGlace payload (datautils.txt) staged on actor-controlled GitHub repositories. Stage payloads are protected with layered obfuscation: XOR (downloader keys 'sgznqhtgnghvmzxponum' and 'AadDDRTaSPtyAG57er#$ad!lDKTOPLTEL78pE'), a modified RC4 routine, Base64 encoding, and AES-128-CBC (KEY B0747C82C23359D1342B47A669796989 / IV 21A44712685A8BA42985783B67883999) for SpyGlace strings and C2 traffic.
SpyGlace is a long-running APT-C-60 backdoor first surfaced by ThreatBook in 2022; the 2025 variants are versioned 3.1.12 (built 2025-06-27), 3.1.13 (2025-07-03) and 3.1.14 (2025-07-16). The 3.1.14 build moved its execution path from %public%\AccountPictures\Default\ to %appdata%\Microsoft\SystemCertificates\My\CPLs. SpyGlace exposes ~18 operator commands (cd, ddir, ddel, ld, uld, attach, detach, procspawn, diskinfo, download, downfree, cancel, screenupload, screenauto, upload; prockill/proclist disabled in these builds, uld added to unload modules), supporting file/directory enumeration, file collection, process spawning, disk reconnaissance, screen capture and C2 exfiltration. The actor fingerprints victims with the disk Volume Serial Number plus Computer Name, embedding this identifier into GitHub payload filenames and HTTP referer headers for unique device tracking; JPCERT identified ~12 compromised devices this way.
Command-and-control uses an actor IP at 185.181.230.71 under path /wkdo9/ with rotating ASP endpoints (4b3ru.asp, t1802.asp, n3tb4.asp, 2qpmk.asp), with Statcounter (c.statcounter.com/13139439/0/1ba1a548/1/) abused as a legitimate-web-service dead-drop resolver and legacy Bitbucket (bitbucket.org/clouds999/glo29839/downloads/) retained from earlier campaigns. Attribution to APT-C-60 is supported by the embedded 'GOLDBAR' userid marker (MD5 in C2 traffic) consistent with prior operations, TTP overlap with August 2024 attacks (which exploited CVE-2024-7262 in WPS Office to deliver SpyGlace), and the broader assessment by Chuangyu 404 Lab and Positive Technologies that APT-C-60 and APT-Q-12 are sub-clusters of DarkHotel. This campaign uses no CVE; initial access is purely social engineering plus VHDX/LNK packaging and Git LOLBin abuse.
MITRE ATT&CK techniques used in TL-2026-0777
Collection
T1005 Data from Local System; T1113 Screen Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1480 Execution Guardrails; T1564 Hide Artifacts
Exfiltration
T1041 Exfiltration Over C2 Channel
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1132 Data Encoding; T1573 Encrypted Channel
stealth
T1202 Indirect Command Execution; T1574 Hijack Execution Flow
Persistence
T1546 Event Triggered Execution
Initial Access
Affected products and versions in APT-C-60 Spear-Phishing Campaign Deploying SpyGlace Spyware
- Microsoft — Windows
Vulnerable versions: VHDX auto-mount + COM-hijack exposed hosts - Git for Windows / MinGW — Git command binary (gcmd.exe)
Vulnerable versions: abused as LOLBin; not a product vulnerability
Remediation for APT-C-60 Spear-Phishing Campaign Deploying SpyGlace Spyware
Immediate actions
- Block C2 IP 185.181.230.71 and the /wkdo9/ ASP endpoints at the perimeter
- Block/alert on the actor GitHub repos (carolab989/class2025, football2025/class2025, fenchiuwu/class2025, goldbars33/ozbdkak33, Ridgley22387/r834829jf) and bitbucket.org/clouds999/glo29839
- Alert on outbound requests to c.statcounter.com/13139439/0/1ba1a548/1/
- Quarantine any host matching the SpyGlace/downloader SHA256 hashes
- Hunt for COM hijack value HKCU\Software\Classes\CLSID\{566296fe-e0e8-475f-ba9c-a31ad31620b1}\InProcServer32
Workarounds
- Disable automatic mounting of virtual disk images for standard users
- Strip .lnk and container attachments at the mail gateway
- Remove/monitor write access to HKCU CLSID InProcServer32 keys
Longer-term hardening
- Deploy EDR with behavioral detection for LOLBin abuse and COM hijacking
- Restrict or alert on auto-mounting of VHD/VHDX email attachments
- Application control to govern execution of developer utilities (git/gcmd.exe) outside dev contexts
- Mark of the Web / attachment-detonation in mail gateway for container file types (.vhdx, .iso, .img)
CVEs associated with APT-C-60 Spear-Phishing Campaign Deploying SpyGlace Spyware
Timeline of APT-C-60 Spear-Phishing Campaign Deploying SpyGlace Spyware
- SpyGlace (SpyGrace) backdoor first surfaced by ThreatBook and attributed to APT-C-60.
- APT-C-60 exploits WPS Office RCE (CVE-2024-7262) to deploy SpyGlace against a Japanese organization using a job-application lure.
- Public reporting documents APT-C-60 abuse of StatCounter, Bitbucket and Google Drive to deliver SpyGlace.
- SpyGlace v3.1.12 built/uploaded (2025-06-27 14:33:28 +0900).
- SpyGlace v3.1.13 built/uploaded (2025-07-03 18:25:18 +0900).
- SpyGlace v3.1.14 built/uploaded (2025-07-16 15:03:52 +0900); execution path moved to %appdata%\Microsoft\SystemCertificates\My\CPLs.
- Actor shifts payload distribution from Bitbucket to actor-controlled GitHub repositories while retaining Statcounter dead-drop and C2 at 185.181.230.71.
- JPCERT observes ongoing VHDX/LNK spear-phishing against Japanese recruitment staff through August 2025; ~12 compromised devices identified.
- JPCERT/CC (Yuma Masubuchi) publishes the APT-C-60 attack update report with full IOCs.
Sources cited for APT-C-60 Spear-Phishing Campaign Deploying SpyGlace Spyware
- JPCERT/CC Eyes: APT-C-60 Attack Update Report
- APT-C-60 Deploys Updated SpyGlace Malware In Japan Espionage
- APT-C-60 Hackers Exploit StatCounter and Bitbucket in SpyGlace Malware Campaign
- APT-C-60 Group Exploit WPS Office Flaw (CVE-2024-7262) to Deploy SpyGlace Backdoor
- DarkHotel: A cluster of groups united by common techniques (Positive Technologies)
- APT-C-60 (Threat Actor) — Malpedia
- APT-C-60 Leverages WPS Office Vulnerability to Install SpyGlace Backdoor — Active IOCs (Rewterz)
Detection coverage for TL-2026-0777
As of 2026-06-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0777 across Splunk SPL, Microsoft KQL and Sigma, covering 40 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.