APT-C-60 2026 Campaign: SpyGlace Backdoor Delivered via LNK Files and Abused Legitimate Services
APT-C-60 2026 Campaign (TL-2026-1249), also tracked as SpyGlace Campaign 2026, is a high-severity malware campaign, first published 2026-07-13. It is attributed to APT-C-60 (South Korea) with medium confidence, affects Microsoft Windows (mshta.exe / LNK shortcut execution), maps to 21 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 35 indicators of compromise.
Key facts for TL-2026-1249
- Threat ID
- TL-2026-1249
- Also known as
- SpyGlace Campaign 2026, APT-C-60 Legitimate Service Abuse Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-13
- Last reviewed
- 2026-07-13
- Attribution
- APT-C-60
- Attribution confidence
- MEDIUM
- Nation-state nexus
- South Korea
- Motivation
- ESPIONAGE
- Target sectors
- government administration, trade, humanresources, recruitment, corporate
- Target regions
- japan, East Asia, south korea, china, taiwan
- Detection rules
- 9
- Indicators of compromise
- 35
Malware and tooling in APT-C-60 2026 Campaign
Malware and tooling: SpyGrace, git.exe / gcmd.exe
JPCERT/CC reports a July 2026 APT-C-60 campaign against Japanese organizations that shifts initial access to Proton Drive-hosted spear-phishing RAR archives containing LNK files, which invoke mshta.exe to run obfuscated JavaScript fetching payloads from jsDelivr and executing them via legitimate git.exe. GitHub, GitLab, jsDelivr, Codeberg, and Bitbucket are abused for C2 and payload staging to deploy SpyGlace backdoor versions 3.1.15, 3.1.17, and 3.1.18.
How APT-C-60 2026 Campaign works
APT-C-60 (aka APT-Q-12), a South Korea-aligned cyber-espionage group tracked since 2021 and linked to the broader DarkHotel cluster, has continued targeting Japanese and East Asian organizations with its custom SpyGlace backdoor. JPCERT/CC's July 2026 report documents a new initial-access chain: spear-phishing emails from Proton Drive-registered senders (asako.t1011@protonmail.com, ayuko0328@protonmail.com) deliver links to RAR archives containing LNK (shortcut) files. When opened, the LNK copies itself and invokes mshta.exe to execute embedded, obfuscated JavaScript. That JavaScript downloads a component (contributing[1].txt) from the jsDelivr CDN, decodes/extracts it, and uses the legitimate git.exe binary to execute scripts from the extracted folder — a living-off-the-land technique that masks malicious activity behind trusted developer tooling. GitHub, GitLab, jsDelivr, Codeberg, and (per prior 2025 campaigns) Bitbucket and Statcounter are abused as C2 channels and payload-staging infrastructure, with attacker-controlled repositories (e.g. github.com/mei1990789/class125, gitlab.com/sapphire689/dnaluakxit, codeberg.org/ochi_ma992/3tv9239irfn83) hosting downloader components and exfiltrated victim-identification data. The campaign deploys three updated SpyGlace backdoor builds (v3.1.15, v3.1.17, v3.1.18) that JPCERT/CC assesses show no major functional differences from the immediately preceding Q3 2025 releases (v3.1.12-v3.1.14), which themselves disabled the 'prockill'/'proclist' commands and added a module load/execute/unload ('uld') command. SpyGlace communicates with C2 using BASE64 encoding layered over a modified RC4 stream cipher (triple KSA cycles, custom key material), with downloaded files separately protected by AES-128-CBC. Seven C2 IP addresses are documented for the 2026 campaign. GitHub repositories used for staging were found to contain Windows Volume Serial Numbers and computer names from at least 24 compromised Japanese devices, confirming successful compromises. The group's 2025 campaigns used VHDX-attachment lures impersonating job applicants/researchers targeting HR and recruitment staff, executing scripts via the Git binary gcmd.exe and establishing persistence through COM hijacking of CLSID {566296fe-e0e8-475f-ba9c-a31ad31620b1}. APT-C-60 has previously exploited a WPS Office zero-day (CVE-2024-7262) for initial access, underscoring a pattern of combining novel exploitation with abuse of trusted software supply-chain and developer-service infrastructure to evade network and endpoint detection.
MITRE ATT&CK techniques used in TL-2026-1249
Collection
T1005 Data from Local System; T1113 Screen Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information
Exfiltration
T1041 Exfiltration Over C2 Channel
Discovery
T1057 Process Discovery; T1082 System Information Discovery
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1132 Data Encoding; T1573 Encrypted Channel
stealth
T1218 System Binary Proxy Execution
Persistence
T1546 Event Triggered Execution
Initial Access
Resource Development
T1583 Acquire Infrastructure; T1608 Stage Capabilities
Reconnaissance
Affected products and versions in APT-C-60 2026 Campaign
- Microsoft — Windows (mshta.exe / LNK shortcut execution)
Vulnerable versions: all supported Windows versions with default mshta.exe - Various Japanese organizations — Corporate email / endpoint environments
Vulnerable versions: targeted end-user workstations
Remediation for APT-C-60 2026 Campaign
Patches
- Not applicable — no CVE is associated with this specific 2026 initial-access chain; ensure WPS Office is patched against the previously exploited CVE-2024-7262 as a related hardening step
Immediate actions
- Block the documented C2 IP addresses (31.58.136.207, 154.18.239.209, 173.234.11.141, 185.18.222.241, 213.111.158.200/.201/.216, 185.181.230.71) at network perimeter and proxy
- Alert/block on the identified attacker-controlled GitHub/GitLab/Codeberg repository paths
- Hunt for mshta.exe spawning from LNK-opened Explorer processes and for git.exe/gcmd.exe executing non-repository scripts
- Search email gateways for Proton Drive share links and RAR attachments from the identified sender addresses
- Hunt for the documented mutex values and the COM hijack CLSID registry key HKCU\Software\Classes\CLSID\{566296fe-e0e8-475f-ba9c-a31ad31620b1}\InProcServer32
Workarounds
- Disable or restrict mshta.exe execution via AppLocker/WDAC where business use does not require it
- Block direct execution of LNK files from removable/archive-extracted locations via Group Policy
Longer-term hardening
- Deploy application allow-listing / constrained language mode to prevent mshta.exe from executing untrusted script content
- Restrict or monitor outbound traffic to code-hosting and CDN domains (github.com, gitlab.com, cdn.jsdelivr.net, codeberg.org, bitbucket.org) from endpoints where such access is not business-justified
- Deploy EDR behavioral detections for LNK-triggered mshta execution chains and LOLBin (git.exe) script execution
- User-awareness training for HR/recruitment staff on job-application and researcher-CV themed phishing lures
Timeline of APT-C-60 2026 Campaign
- APT-C-60 first discovered/tracked as a distinct cyber-espionage group.
- SpyGlace RAT/backdoor first discovered and documented by ThreatBook.
- APT-C-60 exploits WPS Office zero-day CVE-2024-7262 to deploy SpyGlace.
- JPCERT/CC publishes report on APT-C-60 abusing legitimate services (Bitbucket, Statcounter) for C2.
- SpyGlace version 3.1.12 uploaded/observed.
- SpyGlace version 3.1.13 uploaded/observed.
- SpyGlace version 3.1.14 uploaded/observed.
- JPCERT/CC publishes follow-up report detailing VHDX-lure delivery, COM hijacking persistence, and Statcounter-based victim fingerprinting.
- JPCERT/CC publishes 2026 update describing the Proton Drive/RAR/LNK/mshta.exe initial-access chain, GitHub/GitLab/jsDelivr/Codeberg/Bitbucket abuse, and SpyGlace v3.1.15/v3.1.17/v3.1.18 deployment against 24+ confirmed Japanese victims.
Sources cited for APT-C-60 2026 Campaign
- Update on Attacks by Threat Group APT-C-60 in 2026
- Update on Attacks by Threat Group APT-C-60
- Attack Exploiting Legitimate Service by APT-C-60
- APT-C-60 Deploys Updated SpyGlace Malware In Japan Espionage
- APT-C-60 Hackers Exploit StatCounter and Bitbucket in SpyGlace Malware Campaign
- Attack Group APT-C-60 Targets Japan Using Trusted Platforms
- APT-C-60 (Threat Actor) profile
- APT-C-60 Group Exploit WPS Office Flaw to Deploy SpyGlace Backdoor
Threats related to APT-C-60 2026 Campaign
- APT-C-60 Spear-Phishing Campaign Deploying SpyGlace Spyware (v3.1.12-3.1.14) via VHDX/LNK and Git (gcmd.exe) LOLBin Abuse
- SpyGlace Malware Campaign by APT-C-60 (Naikon) Abuses Trusted Developer Services (GitHub, GitLab, jsDelivr, Codeberg, Bitbucket) to Target Japan
- APT-C-60 Spear-Phishing Campaign Against Japanese Recruiters Using VHDX/LNK and SpyGlace Malware
- Xctdoor Backdoor Delivered via Resume-Themed LNK Files, PowerShell/VBScript Loaders, and ProximityUxHost.exe DLL Side-Loading (Andariel)
- PowMix Botnet Targets Czech Workforce via LNK-Triggered PowerShell Loader with Heroku C2
Detection coverage for TL-2026-1249
As of 2026-07-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1249 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.