# SpyGlace Malware Campaign by APT-C-60 (Naikon) Abuses Trusted Developer Services (GitHub, GitLab, jsDelivr, Codeberg, Bitbucket) to Target Japan

> APT-C-60 (aka Naikon), a South Korea-aligned cyber-espionage group active since 2021, is running a spear-phishing campaign against Japanese organizations that delivers the SpyGlace backdoor (v3.1.15/3.1.17/3.1.18) via Proton Drive-hosted RAR archives and a multi-stage LNK → mshta.exe → git.exe delivery chain. The chain abuses trusted developer platforms (GitHub, GitLab, jsDelivr, Codeberg, Bitbucket) and Statcounter analytics to blend malicious traffic into legitimate infrastructure and evade network-based blocking.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1284
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-spyglace-naikon-trusted-service-abuse-tl-2026-1284.webp?v=a4bd7c18 (Threadlinqs threat intel: APT-C-60 SpyGlace via GitHub, jsDelivr: Detection & IOCs (TL-2026-1284) — High severity, 77 IOCs, 9 detection rules.)
- **ID:** TL-2026-1284
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** APT-C-60 (South Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 77 (3 shown free below)
- **CVEs:** CVE-2024-7262

## Description

APT-C-60 (also tracked as Naikon, and linked to the broader DarkHotel/APT-Q-12 cluster) has been conducting sustained cyber-espionage operations against Japanese organizations since at least 2021, with its custom SpyGlace backdoor observed in the wild as early as June 2022. The July 2026 campaign documented by JPCERT/CC and reported by Cyber Security News begins with spear-phishing emails containing Proton Drive links that deliver password-protected RAR archives. Inside each archive is a Windows shortcut (.lnk) file disguised as a document (e.g., desk.lnk, idx2.lnk, information.lnk, ipo6.lnk). When opened, the LNK invokes mshta.exe, Microsoft's signed HTML Application host, to execute an embedded, obfuscated JavaScript payload. This script retrieves an encoded text file (contributing[1].txt) staged on jsDelivr (a legitimate open-source CDN that mirrors GitHub content), decodes it, and uses it to marshal the legitimate git.exe binary into cloning or fetching further staged content from a network of throwaway GitHub, GitLab, and Codeberg repositories. Fragmented downloader components (TMI003.db through TMI400.db) are reassembled locally into a functional downloader (iconcache.dat, Cached2014.tmp, EncodedFile.tmp) which in turn retrieves and loads the SpyGlace backdoor DLL (ndsdll.dat, dll.tmp, jj.dll, sdll.tmp) into memory. Statcounter's legitimate web-analytics beacon (c.statcounter.com) is abused as a covert device-fingerprinting/check-in mechanism before the final payload is served, allowing operators to filter out sandboxes and non-target victims. This chain mirrors APT-C-60's historical tradecraft: earlier 2024 campaigns used a WPS Office zero-day (CVE-2024-7262) to drop SpyGlace as TaskControler.dll, later campaigns delivered VHDX virtual-disk containers with job-application lures (Self-Introduction.lnk) that install a SecureBootUEFI.dat downloader via COM hijacking (T1546.015) for persistence, using XOR-obfuscated C2 traffic to a Bitbucket-staged C2 (103.187.26.176) and StatCounter for device ID. The July 2026 wave keeps the git.exe/legitimate-platform abuse pattern but shifts distribution to GitHub/GitLab/jsDelivr/Codeberg rather than Bitbucket/Google Drive, and re-uses Proton Drive/Protonmail infrastructure for phishing delivery and operator communications (asako.t1011@protonmail.com, ayuko0328@protonmail.com senders; sapphire679@proton.me, sapphire689@proton.me, meimei91@protonmail.com, rapefo2905@outlook.com, jewexo9791@outlook.com, legDevMachine@protonmail.com commit-author emails on the attacker-controlled repos). SpyGlace itself is a modular reconnaissance/data-exfiltration backdoor; JPCERT/CC's ongoing tracking of the family (versions 3.1.6 in 2024 through 3.1.12-3.1.18 in 2025-2026) shows incremental command-set changes — the prockill and proclist commands were neutered in 3.1.12+ while a new uld (upload) command was added — consistent with continuous operational refinement rather than a rewrite. The malware supports file theft, plugin loading, and arbitrary command execution once implanted, and operators route C2 through 20+ disposable GitHub repos, 8+ GitLab repos, and 3+ Codeberg repos, rotating infrastructure to complicate takedown and network-signature-based blocking. JPCERT/CC recommends defenders shift from destination/domain-based blocking (ineffective against abuse of legitimate CDNs and code-hosting platforms) to behavioral detection: alerting on mshta.exe spawned from LNK/archive contexts, git.exe executing from user-writable/temp directories, and unusual outbound connections from office productivity or HR-adjacent hosts to code-hosting CDNs immediately following email attachment execution.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1218.005 Mshta
- T1546.015 Component Object Model Hijacking
- T1218.005 Mshta
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1497 Virtualization/Sandbox Evasion
- T1087 Account Discovery
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1105 Ingress Tool Transfer
- T1071.001 Web Protocols
- T1102 Web Service
- T1573.001 Symmetric Cryptography
- T1027.007 Dynamic API Resolution
- T1041 Exfiltration Over C2 Channel
- T1584.006 Web Services
- T1583.006 Web Services

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SpyGlace: mshta.exe Execution Following LNK/Archive Context (Exploitation)** (`TL-2026-1284-SPL-001`)

Detects mshta.exe spawned by explorer.exe or an archive-extraction utility (WinRAR/7-Zip) consistent with APT-C-60's LNK-in-RAR spear-phishing delivery (desk.lnk, idx2.lnk, information.lnk, ipo6.lnk) that invokes mshta.exe to run an embedded obfuscated JavaScript payload.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1218.005, T1204.002, T1566.001, T1566.002
- **Data sources:** sysmon, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\mshta.exe"
| where match(ParentImage, "(?i)\\\\(explorer|WinRAR|7zFM|7zG)\.exe$")
| eval lnk_context=if(match(CommandLine, "(?i)(desk|idx2|information|ipo6)\.hta|\.lnk"), "named-artifact-match", "generic")
| table _time, ComputerName, User, ParentImage, Image, CommandLine, lnk_context
| sort -_time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "mshta.exe"
| where ParentFileName in~ ("explorer.exe", "WinRAR.exe", "7zFM.exe", "7zG.exe")
| project Timestamp, DeviceName, AccountName, ParentFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: SpyGlace-style mshta.exe Execution Following Archive/LNK Context
id: 8f2c1e40-1c3a-4b8e-9d2a-a1b2c3d4e5f1
status: experimental
description: Detects mshta.exe spawned by explorer.exe or an archive tool, consistent with the APT-C-60 SpyGlace LNK-in-RAR delivery chain.
references:
    - https://blogs.jpcert.or.jp/en/2025/11/APT-C-60_update.html
    - https://cybersecuritynews.com/spyglace-attacks-abuse-trusted-developer-services/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-13
tags:
    - attack.execution
    - attack.t1218.005
    - attack.t1204.002
    - attack.t1566.001
    - attack.tool.spyglace
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\\mshta.exe'
        ParentImage|endswith:
            - '\\explorer.exe'
            - '\\WinRAR.exe'
            - '\\7zFM.exe'
            - '\\7zG.exe'
    condition: selection
falsepositives:
    - Legitimate HTA-based internal tooling (rare)
level: high
```

**Known false positives:**

- Legitimate internal HTA-based tooling launched via archive utilities in rare enterprise workflows

**Tuning notes:** Exclude known internal HTA deployment tools by ParentImage/CommandLine hash allowlist; correlate with recent Proton Drive/RAR attachment delivery to raise confidence to critical.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SpyGlace: Spearphishing LNK Delivery via Proton Drive/Protonmail Sender (Exploitation) (locked: unlock with TL Creds)
- SpyGlace: Fragmented Downloader Reassembly and Loader Artifact Creation (Post-Exploitation) (locked: unlock with TL Creds)
- SpyGlace: Encrypted C2 Beaconing to Disclosed APT-C-60 Infrastructure (C2/Lateral Movement) (locked: unlock with TL Creds)
- SpyGlace: Archive-Delivered LNK Triggering mshta.exe with Embedded JavaScript (Exploitation) (locked: unlock with TL Creds)
- SpyGlace: COM-Hijack Persistence via [indicator] / [indicator] / CPLs Path (Post-Exploitation) (locked: unlock with TL Creds)
- SpyGlace: Reconnaissance/Discovery Command Cluster Preceding Exfiltration Over C2 (C2/Lateral Movement) (locked: unlock with TL Creds)
- SpyGlace: git.exe LOLBin Abuse for Disposable-Repo Payload Staging (Post-Exploitation) (locked: unlock with TL Creds)
- SpyGlace: StatCounter Fingerprint Beacon Followed by Code-Hosting/CDN Egress (C2/Lateral Movement) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 77)

Defanged, TLP:CLEAR.

- IP address: `31.58.136[.]207`
- URL: `hxxps://cdn[.]jsdelivr[.]net/gh/mei1990789/class125`
- File hash: `f42d0fa77e5101f0f793e055cb963b45b36536b1835b9ea8864b4283b21bb68f`

Full set of 77 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [SpyGlace Attacks Abuse Trusted Developer Services to Evade Network Detection](https://cybersecuritynews.com/spyglace-attacks-abuse-trusted-developer-services/)
- [Spear-Phishing Campaign Uses Proton Drive Links and LNK Files to Deliver SpyGlace](https://gbhackers.com/spear-phishing-uses-proton-drive/)
- [Update on Attacks by Threat Group APT-C-60](https://blogs.jpcert.or.jp/en/2025/11/APT-C-60_update.html)
- [Attack Exploiting Legitimate Service by APT-C-60](https://blogs.jpcert.or.jp/en/2024/12/APT-C-60.html)
- [APT-C-60 Deploys Updated SpyGlace Malware In Japan Espionage](https://cyble.com/blog/apt-c-60-deploys-updated-spyglace-malware-in-japan/)
- [Attack Group APT-C-60 Targets Japan Using Trusted Platforms](https://www.infosecurity-magazine.com/news/aptc60-targets-japan-using-trusted/)
- [APT-C-60 Hackers Exploit StatCounter and Bitbucket in SpyGlace Malware Campaign](https://thehackernews.com/2024/11/apt-c-60-exploits-wps-office.html)
- [APT-C-60 Group Exploit WPS Office Flaw to Deploy SpyGlace Backdoor](https://thehackernews.com/2024/08/apt-c-60-group-exploit-wps-office-flaw.html)
- [APT-C-60 Group Leverages Vulnerability in WPS Office to Install SpyGlace Backdoor – Active IOCs](https://rewterz.com/threat-advisory/apt-c-60-group-leverages-vulnerability-in-wps-office-to-install-spyglace-backdoor-active-iocs)
- [APT-C-60 Escalates SpyGlace Campaigns Targeting Japan with Evolved Malware, Advanced Evasion TTPs](https://cyble.com/blog/apt-c-60-escalates-spyglace-campaigns-targeting-japan-with-evolved-malware-advanced-evasion-ttps/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1284