Threat reportMalwareTL-2026-1284

SpyGlace Malware Campaign by APT-C-60 (Naikon) Abuses Trusted Developer Services (GitHub, GitLab, jsDelivr, Codeberg, Bitbucket) to Target Japan

highACTIVE

APT-C-60 (aka Naikon), a South Korea-aligned cyber-espionage group active since 2021, is running a spear-phishing campaign against Japanese organizations that delivers the SpyGlace backdoor (v3.1.15/3.1.17/3.1.18) via Proton Drive-hosted RAR archives and a multi-stage LNK → mshta.exe → git.exe delivery chain.

Key facts for SpyGlace Naikon trusted-service abuse

Identifiers	TL-2026-1284, CVE-2024-7262
Also known as	SpyGlace Campaign, APT-C-60 2026 Trusted-Platform-Abuse Campaign
Severity	HIGH
Exploitation status	Exploited in the wild; Listed in CISA KEV: CVE-2024-7262 (added 2024-09-03)
EPSS	CVE-2024-7262: 2.9% (86.7th percentile)
Affected products	Multiple Windows endpoints at targeted Japanese organizations
Attribution	APT-C-60 (medium confidence)
Nation-state nexus	South Korea
Malware	SpyGrace
Tools	git.exe, mshta.exe
MITRE ATT&CK techniques	T1005 Data from Local System, T1027 Obfuscated Files or Information, T1027.007 Dynamic API Resolution, T1036.005 Match Legitimate Resource Name or Location, T1041 Exfiltration Over C2 Channel, T1057 Process Discovery, T1059.007 JavaScript, T1071.001 Web Protocols, T1082 System Information Discovery, T1083 File and Directory Discovery, T1087 Account Discovery, T1102 Web Service and 11 more in the attack flow
Motivation	ESPIONAGE
Target sectors	general business, human resources recruitment, government-adjacent enterprise, technology
Target regions	japan, south korea, china, East Asia
Detection rules	9 (1 shown free)
Sources	10 cited sources

Detection coverage for SpyGlace Naikon trusted-service abuse

As of 2026-07-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1284 across Splunk SPL, Microsoft KQL and Sigma, covering 77 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SpyGlace: mshta.exe Execution Following LNK/Archive Context (Exploitation)

Detects mshta.exe spawned by explorer.exe or an archive-extraction utility (WinRAR/7-Zip) consistent with APT-C-60's LNK-in-RAR spear-phishing delivery (desk.lnk, idx2.lnk, information.lnk, ipo6.lnk) that invokes mshta.exe to run an embedded obfuscated JavaScript payload.

Languages: Splunk SPL, Microsoft KQL, Sigma
ATT&CK: T1218.005, T1204.002, T1566.001, T1566.002
Data sources: sysmon, windows_security
Severity: high
Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\mshta.exe"
| where match(ParentImage, "(?i)\\\\(explorer|WinRAR|7zFM|7zG)\.exe$")
| eval lnk_context=if(match(CommandLine, "(?i)(desk|idx2|information|ipo6)\.hta|\.lnk"), "named-artifact-match", "generic")
| table _time, ComputerName, User, ParentImage, Image, CommandLine, lnk_context
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "mshta.exe"
| where ParentFileName in~ ("explorer.exe", "WinRAR.exe", "7zFM.exe", "7zG.exe")
| project Timestamp, DeviceName, AccountName, ParentFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| order by Timestamp desc

Sigma

title: SpyGlace-style mshta.exe Execution Following Archive/LNK Context
id: 8f2c1e40-1c3a-4b8e-9d2a-a1b2c3d4e5f1
status: experimental
description: Detects mshta.exe spawned by explorer.exe or an archive tool, consistent with the APT-C-60 SpyGlace LNK-in-RAR delivery chain.
references:
    - https://blogs.jpcert.or.jp/en/2025/11/APT-C-60_update.html
    - https://cybersecuritynews.com/spyglace-attacks-abuse-trusted-developer-services/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-13
tags:
    - attack.execution
    - attack.t1218.005
    - attack.t1204.002
    - attack.t1566.001
    - attack.tool.spyglace
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\\mshta.exe'
        ParentImage|endswith:
            - '\\explorer.exe'
            - '\\WinRAR.exe'
            - '\\7zFM.exe'
            - '\\7zG.exe'
    condition: selection
falsepositives:
    - Legitimate HTA-based internal tooling (rare)
level: high

Known false positives:

Legitimate internal HTA-based tooling launched via archive utilities in rare enterprise workflows

Tuning notes: Exclude known internal HTA deployment tools by ParentImage/CommandLine hash allowlist; correlate with recent Proton Drive/RAR attachment delivery to raise confidence to critical.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)

SpyGlace: Spearphishing LNK Delivery via Proton Drive/Protonmail Sender (Exploitation) · unlock with TL Creds
SpyGlace: Fragmented Downloader Reassembly and Loader Artifact Creation (Post-Exploitation) · unlock with TL Creds
SpyGlace: Encrypted C2 Beaconing to Disclosed APT-C-60 Infrastructure (C2/Lateral Movement) · unlock with TL Creds
SpyGlace: Archive-Delivered LNK Triggering mshta.exe with Embedded JavaScript (Exploitation) · unlock with TL Creds
SpyGlace: COM-Hijack Persistence via [indicator] / [indicator] / CPLs Path (Post-Exploitation) · unlock with TL Creds
SpyGlace: Reconnaissance/Discovery Command Cluster Preceding Exfiltration Over C2 (C2/Lateral Movement) · unlock with TL Creds
SpyGlace: git.exe LOLBin Abuse for Disposable-Repo Payload Staging (Post-Exploitation) · unlock with TL Creds
SpyGlace: StatCounter Fingerprint Beacon Followed by Code-Hosting/CDN Egress (C2/Lateral Movement) · unlock with TL Creds

Indicators of compromise for SpyGlace Naikon trusted-service abuse

As of 2026-07-13, Threadlinqs Intelligence tracks 77 indicators of compromise for TL-2026-1284.

Sample indicators (3 of 77)

IP address: 31.58.136[.]207
URL: hxxps://cdn[.]jsdelivr[.]net/gh/mei1990789/class125
File hash: f42d0fa77e5101f0f793e055cb963b45b36536b1835b9ea8864b4283b21bb68f

Defanged, TLP:CLEAR. Full set of 77 indicators: unlock with TL Creds.

77 indicators of compromise · unlock with TL Creds. Compare plans

How SpyGlace Naikon trusted-service abuse works

The chain abuses trusted developer platforms (GitHub, GitLab, jsDelivr, Codeberg, Bitbucket) and Statcounter analytics to blend malicious traffic into legitimate infrastructure and evade network-based blocking.

APT-C-60 (also tracked as Naikon, and linked to the broader DarkHotel/APT-Q-12 cluster) has been conducting sustained cyber-espionage operations against Japanese organizations since at least 2021, with its custom SpyGlace backdoor observed in the wild as early as June 2022. The July 2026 campaign documented by JPCERT/CC and reported by Cyber Security News begins with spear-phishing emails containing Proton Drive links that deliver password-protected RAR archives. Inside each archive is a Windows shortcut (.lnk) file disguised as a document (e.g., desk.lnk, idx2.lnk, information.lnk, ipo6.lnk). When opened, the LNK invokes mshta.exe, Microsoft's signed HTML Application host, to execute an embedded, obfuscated JavaScript payload. This script retrieves an encoded text file (contributing[1].txt) staged on jsDelivr (a legitimate open-source CDN that mirrors GitHub content), decodes it, and uses it to marshal the legitimate git.exe binary into cloning or fetching further staged content from a network of throwaway GitHub, GitLab, and Codeberg repositories. Fragmented downloader components (TMI003.db through TMI400.db) are reassembled locally into a functional downloader (iconcache.dat, Cached2014.tmp, EncodedFile.tmp) which in turn retrieves and loads the SpyGlace backdoor DLL (ndsdll.dat, dll.tmp, jj.dll, sdll.tmp) into memory. Statcounter's legitimate web-analytics beacon (c.statcounter.com) is abused as a covert device-fingerprinting/check-in mechanism before the final payload is served, allowing operators to filter out sandboxes and non-target victims. This chain mirrors APT-C-60's historical tradecraft: earlier 2024 campaigns used a WPS Office zero-day (CVE-2024-7262) to drop SpyGlace as TaskControler.dll, later campaigns delivered VHDX virtual-disk containers with job-application lures (Self-Introduction.lnk) that install a SecureBootUEFI.dat downloader via COM hijacking (T1546.015) for persistence, using XOR-obfuscated C2 traffic to a Bitbucket-staged C2 (103.187.26.176) and StatCounter for device ID. The July 2026 wave keeps the git.exe/legitimate-platform abuse pattern but shifts distribution to GitHub/GitLab/jsDelivr/Codeberg rather than Bitbucket/Google Drive, and re-uses Proton Drive/Protonmail infrastructure for phishing delivery and operator communications (asako.t1011@protonmail.com, ayuko0328@protonmail.com senders; sapphire679@proton.me, sapphire689@proton.me, meimei91@protonmail.com, rapefo2905@outlook.com, jewexo9791@outlook.com, legDevMachine@protonmail.com commit-author emails on the attacker-controlled repos). SpyGlace itself is a modular reconnaissance/data-exfiltration backdoor; JPCERT/CC's ongoing tracking of the family (versions 3.1.6 in 2024 through 3.1.12-3.1.18 in 2025-2026) shows incremental command-set changes — the prockill and proclist commands were neutered in 3.1.12+ while a new uld (upload) command was added — consistent with continuous operational refinement rather than a rewrite. The malware supports file theft, plugin loading, and arbitrary command execution once implanted, and operators route C2 through 20+ disposable GitHub repos, 8+ GitLab repos, and 3+ Codeberg repos, rotating infrastructure to complicate takedown and network-signature-based blocking. JPCERT/CC recommends defenders shift from destination/domain-based blocking (ineffective against abuse of legitimate CDNs and code-hosting platforms) to behavioral detection: alerting on mshta.exe spawned from LNK/archive contexts, git.exe executing from user-writable/temp directories, and unusual outbound connections from office productivity or HR-adjacent hosts to code-hosting CDNs immediately following email attachment execution.

MITRE ATT&CK techniques by tactic:

Remediation for SpyGlace Naikon trusted-service abuse

Immediate actions

Block/alert on execution of mshta.exe with parent process being explorer.exe or an archive-extraction utility
Alert on git.exe spawned from user temp/download directories or by non-developer host processes
Block or heavily scrutinize inbound Proton Drive share links and RAR attachments at the email gateway
Add disclosed C2 IPs (31.58.136.207, 154.18.239.209, 173.234.11.141, 185.18.222.241, 213.111.158.200-201/216) and malicious GitHub/GitLab/Codeberg repo paths to network/EDR blocklists
Hunt for the named artifact filenames (iconcache.dat, Cached2014.tmp, EncodedFile.tmp, ndsdll.dat, dll.tmp, jj.dll, sdll.tmp, TMI*.db) across endpoints

Workarounds

Disable or restrict mshta.exe execution via AppLocker/WDAC for non-IT user groups
Restrict or monitor local git.exe installations on end-user workstations that have no developer function

Longer-term hardening

Deploy behavioral/EDR detection for LNK->mshta->git.exe execution chains rather than relying on destination-based blocking of CDN/code-hosting domains
Implement DMARC/SPF/DKIM enforcement and sender-reputation scrutiny for Proton Drive/Protonmail-originated mail
Establish egress monitoring/allowlisting for developer-platform traffic (github.com, gitlab.com, cdn.jsdelivr.net, codeberg.org) originating from non-developer business units
Track SpyGlace family command-set evolution via threat-intel feeds and update YARA/Sigma signatures each JPCERT/CC update cycle

Affected and fixed versions

Multiple — Windows endpoints at targeted Japanese organizations
Vulnerable versions: Any Windows host with mshta.exe and git.exe available

Timeline of SpyGlace Naikon trusted-service abuse

2022-06-01 locked-ioc-71 backdoor first detected in the wild, attributed to APT-C-60 (Naikon).
2024-08-01 APT-C-60 exploits WPS Office zero-day CVE-2024-7262 to drop locked-ioc-71 as locked-ioc-44; SpyGrace v3.1.6 identified by ESET; parallel wave observed targeting recruitment/HR staff via spear-phishing with malicious VHDX attachments delivering a Downloader1 persisted via COM hijacking (locked-ioc-45) and Statcounter-based C2 beaconing.
2024-11-01 Campaign observed abusing locked-ioc-61 (device fingerprinting) and locked-ioc-65 (payload staging) alongside Google Drive-delivered VHDX lures with job-application themes.
2024-12-01 JPCERT/CC publishes first detailed report on APT-C-60's abuse of legitimate services against Japanese organizations.
2025-06-27 locked-ioc-71 v3.1.12 uploaded to attacker-controlled GitHub repository at 14:33:28 +0900; prockill and proclist commands disabled relative to v3.1.6.
2025-07-03 locked-ioc-71 v3.1.13 uploaded to GitHub at 18:25:18 +0900, with minor code differences and a distinct mutex value from v3.1.12.
2025-07-16 locked-ioc-71 v3.1.14 uploaded to GitHub at 15:03:52 +0900, introducing a new execution/persistence path under %appdata%\Microsoft\SystemCertificates\My\CPLs and a further distinct mutex value.
2025-09-01 JPCERT/CC reports an overseas (non-Japan) APT-C-60 campaign wave using locked-ioc-71 v3.1.14.
2025-10-01 Cyble reports APT-C-60 escalating locked-ioc-71 campaigns against Japan with evolved malware and advanced evasion TTPs.
2025-11-01 JPCERT/CC publishes update covering attacks between June-August 2025, documenting locked-ioc-71 versions 3.1.12-3.1.14 with modified prockill/proclist commands and a new uld (upload) command.
2026-07-13 Disclosed IOC set for the current wave includes 7 C2 IPs, 18+ attacker-controlled GitHub accounts, phishing sender and commit-author email addresses, and named LNK/loader/backdoor artifact filenames, enabling defender blocklisting and endpoint hunting.
2026-07-13 Cyber Security News and GBHackers report a new APT-C-60 spear-phishing campaign delivering locked-ioc-71 v3.1.15/3.1.17/3.1.18 via locked-ioc-59 RAR archives and an LNK -> locked-ioc-64 -> jsDelivr -> locked-ioc-74 -> GitHub/GitLab/Codeberg delivery chain, citing a JPCERT/CC analysis.