SpyGlace Malware Campaign by APT-C-60 (Naikon) Abuses Trusted Developer Services (GitHub, GitLab, jsDelivr, Codeberg, Bitbucket) to Target Japan
SpyGlace Malware Campaign by APT-C-60 (Naikon) Abuses (TL-2026-1284), also tracked as SpyGlace Campaign, is a high-severity malware campaign, first published 2026-07-13. It is attributed to APT-C-60 (South Korea) with medium confidence, affects Multiple Windows endpoints at targeted Japanese organizations, maps to 23 MITRE ATT&CK techniques (T1005, T1027, T1027.007), and is covered by 9 detection rules and 77 indicators of compromise.
Key facts for TL-2026-1284
- Threat ID
- TL-2026-1284
- Also known as
- SpyGlace Campaign, APT-C-60 2026 Trusted-Platform-Abuse Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-13
- Last reviewed
- 2026-07-13
- Attribution
- APT-C-60
- Attribution confidence
- MEDIUM
- Nation-state nexus
- South Korea
- Motivation
- ESPIONAGE
- Target sectors
- general business, human resources recruitment, government-adjacent enterprise, technology
- Target regions
- japan, south korea, china, East Asia
- Detection rules
- 9
- Indicators of compromise
- 77
Malware and tooling in SpyGlace Malware Campaign by APT-C-60 (Naikon) Abuses
Malware and tooling: SpyGrace, git.exe, mshta.exe
APT-C-60 (aka Naikon), a South Korea-aligned cyber-espionage group active since 2021, is running a spear-phishing campaign against Japanese organizations that delivers the SpyGlace backdoor (v3.1.15/3.1.17/3.1.18) via Proton Drive-hosted RAR archives and a multi-stage LNK → mshta.exe → git.exe delivery chain. The chain abuses trusted developer platforms (GitHub, GitLab, jsDelivr, Codeberg, Bitbucket) and Statcounter analytics to blend malicious traffic into legitimate infrastructure and evade network-based blocking.
How SpyGlace Malware Campaign by APT-C-60 (Naikon) Abuses works
APT-C-60 (also tracked as Naikon, and linked to the broader DarkHotel/APT-Q-12 cluster) has been conducting sustained cyber-espionage operations against Japanese organizations since at least 2021, with its custom SpyGlace backdoor observed in the wild as early as June 2022. The July 2026 campaign documented by JPCERT/CC and reported by Cyber Security News begins with spear-phishing emails containing Proton Drive links that deliver password-protected RAR archives. Inside each archive is a Windows shortcut (.lnk) file disguised as a document (e.g., desk.lnk, idx2.lnk, information.lnk, ipo6.lnk). When opened, the LNK invokes mshta.exe, Microsoft's signed HTML Application host, to execute an embedded, obfuscated JavaScript payload. This script retrieves an encoded text file (contributing[1].txt) staged on jsDelivr (a legitimate open-source CDN that mirrors GitHub content), decodes it, and uses it to marshal the legitimate git.exe binary into cloning or fetching further staged content from a network of throwaway GitHub, GitLab, and Codeberg repositories. Fragmented downloader components (TMI003.db through TMI400.db) are reassembled locally into a functional downloader (iconcache.dat, Cached2014.tmp, EncodedFile.tmp) which in turn retrieves and loads the SpyGlace backdoor DLL (ndsdll.dat, dll.tmp, jj.dll, sdll.tmp) into memory. Statcounter's legitimate web-analytics beacon (c.statcounter.com) is abused as a covert device-fingerprinting/check-in mechanism before the final payload is served, allowing operators to filter out sandboxes and non-target victims. This chain mirrors APT-C-60's historical tradecraft: earlier 2024 campaigns used a WPS Office zero-day (CVE-2024-7262) to drop SpyGlace as TaskControler.dll, later campaigns delivered VHDX virtual-disk containers with job-application lures (Self-Introduction.lnk) that install a SecureBootUEFI.dat downloader via COM hijacking (T1546.015) for persistence, using XOR-obfuscated C2 traffic to a Bitbucket-staged C2 (103.187.26.176) and StatCounter for device ID. The July 2026 wave keeps the git.exe/legitimate-platform abuse pattern but shifts distribution to GitHub/GitLab/jsDelivr/Codeberg rather than Bitbucket/Google Drive, and re-uses Proton Drive/Protonmail infrastructure for phishing delivery and operator communications (asako.t1011@protonmail.com, ayuko0328@protonmail.com senders; sapphire679@proton.me, sapphire689@proton.me, meimei91@protonmail.com, rapefo2905@outlook.com, jewexo9791@outlook.com, legDevMachine@protonmail.com commit-author emails on the attacker-controlled repos). SpyGlace itself is a modular reconnaissance/data-exfiltration backdoor; JPCERT/CC's ongoing tracking of the family (versions 3.1.6 in 2024 through 3.1.12-3.1.18 in 2025-2026) shows incremental command-set changes — the prockill and proclist commands were neutered in 3.1.12+ while a new uld (upload) command was added — consistent with continuous operational refinement rather than a rewrite. The malware supports file theft, plugin loading, and arbitrary command execution once implanted, and operators route C2 through 20+ disposable GitHub repos, 8+ GitLab repos, and 3+ Codeberg repos, rotating infrastructure to complicate takedown and network-signature-based blocking. JPCERT/CC recommends defenders shift from destination/domain-based blocking (ineffective against abuse of legitimate CDNs and code-hosting platforms) to behavioral detection: alerting on mshta.exe spawned from LNK/archive contexts, git.exe executing from user-writable/temp directories, and unusual outbound connections from office productivity or HR-adjacent hosts to code-hosting CDNs immediately following email attachment execution.
MITRE ATT&CK techniques used in TL-2026-1284
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1027.007 Dynamic API Resolution; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1218.005 Mshta; T1497 Virtualization/Sandbox Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087 Account Discovery
Execution
T1059.007 JavaScript; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer; T1573.001 Symmetric Cryptography
stealth
Persistence
T1546.015 Component Object Model Hijacking
Initial Access
T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Resource Development
Affected products and versions in SpyGlace Malware Campaign by APT-C-60 (Naikon) Abuses
- Multiple — Windows endpoints at targeted Japanese organizations
Vulnerable versions: Any Windows host with mshta.exe and git.exe available
Remediation for SpyGlace Malware Campaign by APT-C-60 (Naikon) Abuses
Immediate actions
- Block/alert on execution of mshta.exe with parent process being explorer.exe or an archive-extraction utility
- Alert on git.exe spawned from user temp/download directories or by non-developer host processes
- Block or heavily scrutinize inbound Proton Drive share links and RAR attachments at the email gateway
- Add disclosed C2 IPs (31.58.136.207, 154.18.239.209, 173.234.11.141, 185.18.222.241, 213.111.158.200-201/216) and malicious GitHub/GitLab/Codeberg repo paths to network/EDR blocklists
- Hunt for the named artifact filenames (iconcache.dat, Cached2014.tmp, EncodedFile.tmp, ndsdll.dat, dll.tmp, jj.dll, sdll.tmp, TMI*.db) across endpoints
Workarounds
- Disable or restrict mshta.exe execution via AppLocker/WDAC for non-IT user groups
- Restrict or monitor local git.exe installations on end-user workstations that have no developer function
Longer-term hardening
- Deploy behavioral/EDR detection for LNK->mshta->git.exe execution chains rather than relying on destination-based blocking of CDN/code-hosting domains
- Implement DMARC/SPF/DKIM enforcement and sender-reputation scrutiny for Proton Drive/Protonmail-originated mail
- Establish egress monitoring/allowlisting for developer-platform traffic (github.com, gitlab.com, cdn.jsdelivr.net, codeberg.org) originating from non-developer business units
- Track SpyGlace family command-set evolution via threat-intel feeds and update YARA/Sigma signatures each JPCERT/CC update cycle
Timeline of SpyGlace Malware Campaign by APT-C-60 (Naikon) Abuses
- SpyGlace backdoor first detected in the wild, attributed to APT-C-60 (Naikon).
- APT-C-60 exploits WPS Office zero-day CVE-2024-7262 to drop SpyGlace as TaskControler.dll; SpyGrace v3.1.6 identified by ESET; parallel wave observed targeting recruitment/HR staff via spear-phishing with malicious VHDX attachments delivering a Downloader1 persisted via COM hijacking (WebClassUser.dat) and Statcounter-based C2 beaconing.
- Campaign observed abusing StatCounter (device fingerprinting) and Bitbucket (payload staging) alongside Google Drive-delivered VHDX lures with job-application themes.
- JPCERT/CC publishes first detailed report on APT-C-60's abuse of legitimate services against Japanese organizations.
- SpyGlace v3.1.12 uploaded to attacker-controlled GitHub repository at 14:33:28 +0900; prockill and proclist commands disabled relative to v3.1.6.
- SpyGlace v3.1.13 uploaded to GitHub at 18:25:18 +0900, with minor code differences and a distinct mutex value from v3.1.12.
- SpyGlace v3.1.14 uploaded to GitHub at 15:03:52 +0900, introducing a new execution/persistence path under %appdata%\Microsoft\SystemCertificates\My\CPLs and a further distinct mutex value.
- JPCERT/CC reports an overseas (non-Japan) APT-C-60 campaign wave using SpyGlace v3.1.14.
- Cyble reports APT-C-60 escalating SpyGlace campaigns against Japan with evolved malware and advanced evasion TTPs.
- JPCERT/CC publishes update covering attacks between June-August 2025, documenting SpyGlace versions 3.1.12-3.1.14 with modified prockill/proclist commands and a new uld (upload) command.
- Disclosed IOC set for the current wave includes 7 C2 IPs, 18+ attacker-controlled GitHub accounts, phishing sender and commit-author email addresses, and named LNK/loader/backdoor artifact filenames, enabling defender blocklisting and endpoint hunting.
- Cyber Security News and GBHackers report a new APT-C-60 spear-phishing campaign delivering SpyGlace v3.1.15/3.1.17/3.1.18 via Proton Drive RAR archives and an LNK -> mshta.exe -> jsDelivr -> git.exe -> GitHub/GitLab/Codeberg delivery chain, citing a JPCERT/CC analysis.
Sources cited for SpyGlace Malware Campaign by APT-C-60 (Naikon) Abuses
- SpyGlace Attacks Abuse Trusted Developer Services to Evade Network Detection
- Spear-Phishing Campaign Uses Proton Drive Links and LNK Files to Deliver SpyGlace
- Update on Attacks by Threat Group APT-C-60
- Attack Exploiting Legitimate Service by APT-C-60
- APT-C-60 Deploys Updated SpyGlace Malware In Japan Espionage
- Attack Group APT-C-60 Targets Japan Using Trusted Platforms
- APT-C-60 Hackers Exploit StatCounter and Bitbucket in SpyGlace Malware Campaign
- APT-C-60 Group Exploit WPS Office Flaw to Deploy SpyGlace Backdoor
- APT-C-60 Group Leverages Vulnerability in WPS Office to Install SpyGlace Backdoor – Active IOCs
- APT-C-60 Escalates SpyGlace Campaigns Targeting Japan with Evolved Malware, Advanced Evasion TTPs
Threats related to SpyGlace Malware Campaign by APT-C-60 (Naikon) Abuses
- APT-C-60 Spear-Phishing Campaign Against Japanese Recruiters Using VHDX/LNK and SpyGlace Malware
- APT-C-60 2026 Campaign: SpyGlace Backdoor Delivered via LNK Files and Abused Legitimate Services
- APT-C-60 Spear-Phishing Campaign Deploying SpyGlace Spyware (v3.1.12-3.1.14) via VHDX/LNK and Git (gcmd.exe) LOLBin Abuse
Detection coverage for TL-2026-1284
As of 2026-07-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1284 across Splunk SPL, Microsoft KQL and Sigma, covering 77 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.