# APT-C-60 Spear-Phishing Campaign Against Japanese Recruiters Using VHDX/LNK and SpyGlace Malware

> JPCERT/CC documented a June-August 2025 spear-phishing campaign by APT-C-60 against Japanese recruitment staff. Attackers impersonating job applicants attached malicious VHDX disk images containing LNK loaders that abuse the legitimate Git executable to launch a script-driven infection chain deploying two downloaders and the SpyGlace backdoor (v3.1.12-3.1.14), using COM hijacking for persistence and GitHub plus the legitimate Statcounter analytics service for C2.

- **Published:** 2026-08-24T00:00:00Z
- **Last reviewed:** 2026-08-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2134
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-apt-c-60-japanese-recruiter-lure-tl-2026-2134.webp?v=83645b6c (Threadlinqs threat intel: APT-C-60 SpyGlace Japanese Job Lure: Detection & IOCs (TL-2026-2134) — High severity, 24 IOCs, 9 detection rules.)
- **ID:** TL-2026-2134
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** APT-C-60 (South Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (3 shown free below)

## Description

APT-C-60 is an East-Asia-focused cyber-espionage cluster (possibly a sub-cluster of the broader DarkHotel activity set per Positive Technologies and Chuangyu 404 Lab research) that has run recruitment-themed spear-phishing operations against Japanese organizations since at least August 2024, when JPCERT/CC first documented a campaign delivering a malicious VHDX file via Google Drive links to Japanese recruitment contacts, deploying SpyGlace v3.1.6 and abusing Bitbucket and Statcounter for C2 (C2 servers 103.6.244.46 and 103.187.26.176).

In the June-August 2025 wave analyzed here, the group evolved its delivery: rather than hosting the VHDX on Google Drive, the malicious virtual disk image (disguised as a candidate CV, e.g. 'CV & Professional Experience.vhdx') is now attached directly to the phishing email. Opening the VHDX and clicking the embedded LNK ('Resume.rtf.lnk') runs a command that changes into a bundled 'LICENSES.LOG\mingw64\bin' directory and pipes a script file (glog.txt) into the legitimate Git executable (renamed/invoked as gcmd.exe), a living-off-the-land technique that avoids dropping an obviously malicious binary.

The script chain retrieves two downloader stages: WebClassUser.dat (Downloader1), which builds a referrer string encoding the victim's volume serial number and computer name, beacons it to a public Statcounter tracking pixel (statcounter.com/13139439) and to attacker-controlled GitHub repositories (raw.githubusercontent.com URLs built from the same victim identifier) to fetch tasking, and persists via a COM-hijacked CLSID InProcServer32 registry value; and WebCacheR.tmp.dat (Downloader2), which XOR-decodes and loads the SpyGlace backdoor. SpyGlace (versions 3.1.12, 3.1.13, and 3.1.14 were observed being iterated and re-uploaded to GitHub between June 27 and July 16, 2025) supports AES-128-CBC-encrypted download commands, an initial beacon built from MD5/custom-RC4-encoded host data, remote beacon-interval tuning, DLL-module loading/unloading, and screenshot collection staged to a file disguised as a cloud-sync database (Clouds.db). Version 3.1.14 relocated its autorun persistence path to mimic a Windows certificate store directory (%appdata%\Microsoft\SystemCertificates\My\CPLs) and reworked its screenshot-upload routine.

Infrastructure for the 2025 wave combines GitHub accounts/repositories (used both to stage payloads and as a dead-drop for victim-specific tasking files) with a dedicated C2 server (185.181.230.71) serving ASP-based command endpoints, alongside continued abuse of the legitimate Statcounter web-analytics service for low-noise beaconing. Twelve distinct victim device identifiers were recoverable from the GitHub repositories used as dead drops. JPCERT/CC's report cross-references a September 2025 Sangfor writeup on SpyGlace v3.1.14 (a separate campaign outside Japan) and Positive Technologies' DarkHotel-cluster research correlating APT-C-60's TTPs with other suspected DarkHotel-affiliated groups (APT-C-60, APT-Q-12/'Pseudo Hunter'), which several open-source reports tentatively attribute to a South Korea-nexus actor; JPCERT/CC itself does not publish a nation-state attribution.

## MITRE ATT&CK

- T1608.001 Stage Capabilities: Upload Malware
- T1585.003 Establish Accounts: Cloud Accounts
- T1566.001 Phishing: Spearphishing Attachment
- T1204.002 User Execution: Malicious File
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1546.015 Event Triggered Execution: Component Object Model Hijacking
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1082 System Information Discovery
- T1113 Screen Capture
- T1102.001 Web Service: Dead Drop Resolver
- T1071.001 Application Layer Protocol: Web Protocols
- T1132.001 Data Encoding: Standard Encoding
- T1573.001 Encrypted Channel: Symmetric Cryptography

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**APT-C-60 COM-Hijack Persistence and SpyGlace Certificate-Store/Clouds.db Masquerade** (`TL-2026-2134-SPL-002`)

Detects post-exploitation persistence and staging artifacts: Downloader1's COM-hijacked CLSID InProcServer32 registry write, SpyGlace v3.1.14's autorun path relocated to mimic a Windows certificate-store directory (%appdata%\Microsoft\SystemCertificates\My\CPLs), and the Clouds.db file used to disguise staged screenshot captures as a cloud-sync database.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1546.015, T1036.005, T1113, T1082, T1027
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=13 OR EventCode=11)
| where (EventCode=13 AND match(TargetObject, "(?i)CLSID\\\{566296fe-e0e8-475f-ba9c-a31ad31620b1\}\\InProcServer32"))
   OR (EventCode=11 AND (match(TargetFilename, "(?i)SystemCertificates\\My\\CPLs") OR match(TargetFilename, "(?i)Windows\\Clouds\\Clouds\.db")))
| eval indicator_type=case(match(TargetObject,"CLSID"), "com_hijack_persistence", match(TargetFilename,"CPLs"), "spyglace_autorun_masquerade", match(TargetFilename,"Clouds\.db"), "screenshot_staging_masquerade")
| stats count min(_time) as first_seen max(_time) as last_seen by ComputerName, User, Image, TargetObject, TargetFilename, indicator_type
| where count > 0
```

### Microsoft KQL

```kql
let ComHijack = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"CLSID\{566296fe-e0e8-475f-ba9c-a31ad31620b1}\InProcServer32"
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, Artifact=RegistryKey, Detail=tostring(RegistryValueData), InitiatingProcess=InitiatingProcessFileName, IndicatorType="com_hijack_persistence";
let AutorunMasquerade = DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has @"SystemCertificates\My\CPLs" or FolderPath has @"Windows\Clouds\Clouds.db"
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, Artifact=FolderPath, Detail=FileName, InitiatingProcess=InitiatingProcessFileName, IndicatorType=iff(FolderPath has "CPLs", "spyglace_autorun_masquerade", "screenshot_staging_masquerade");
ComHijack
| union AutorunMasquerade
| sort by Timestamp desc
```

### Sigma

```yaml
title: APT-C-60 COM-Hijack Persistence CLSID Registry Write
id: 3d4e5f6a-7b8c-49d0-a1e2-f3b4c5d6e7f8
status: experimental
description: Detects a registry write to the COM-hijacked CLSID InProcServer32 value used by APT-C-60's Downloader1 for persistence in the 2025 campaign wave against Japanese recruitment staff.
references:
    - https://blogs.jpcert.or.jp/en/2025/11/APT-C-60_update.html
author: AII-Detector -- ThreadLinqs Intelligence
date: 2026-08-24
tags:
    - attack.persistence
    - attack.t1546.015
    - attack.t1036.005
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains: 'CLSID\{566296fe-e0e8-475f-ba9c-a31ad31620b1}\InProcServer32'
    condition: selection
falsepositives:
    - Legitimate re-registration of the same CLSID by an installer (extremely unlikely; this CLSID is attacker-hijacked and not owned by common COM servers)
level: high

```

**Known false positives:**

- Legitimate software installers occasionally rewrite unrelated CLSID InProcServer32 values, but reuse of this specific CLSID is not expected outside this campaign
- A legitimate certificate-management tool writing to the real Windows certificate store path (verify the exact 'CPLs' subdirectory and file hash before alerting)

**Tuning notes:** Pair the registry-event Sigma rule with a companion file_event rule for %appdata%\Microsoft\SystemCertificates\My\CPLs and %LocalAppData%\Microsoft\Windows\Clouds\Clouds.db to cover the SpyGlace v3.1.14 autorun/screenshot-staging masquerade paths captured in the SPL/KQL forms; allowlist known certificate-management or backup agents that legitimately touch the real SystemCertificates store.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- APT-C-60 VHDX-Delivered LNK Loader Abusing Git LOLBin (gcmd.exe) to Run glog.txt (locked: unlock with TL Creds)
- APT-C-60 COM-Hijack Persistence and SpyGlace Certificate-Store/Clouds.db Masquerade (locked: unlock with TL Creds)
- APT-C-60 C2 Beaconing via Statcounter Abuse, GitHub Dead-Drop, and ASP C2 Endpoint (locked: unlock with TL Creds)
- APT-C-60 VHDX-Delivered LNK Loader Abusing Git LOLBin (gcmd.exe) to Run glog.txt (locked: unlock with TL Creds)
- APT-C-60 COM-Hijack Persistence and SpyGlace Certificate-Store/Clouds.db Masquerade (locked: unlock with TL Creds)
- APT-C-60 C2 Beaconing via Statcounter Abuse, GitHub Dead-Drop, and ASP C2 Endpoint (locked: unlock with TL Creds)
- APT-C-60 VHDX-Delivered LNK Loader Abusing Git LOLBin (gcmd.exe) to Run glog.txt (locked: unlock with TL Creds)
- APT-C-60 C2 Beaconing via Statcounter Abuse, GitHub Dead-Drop, and ASP C2 Endpoint (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 24)

Defanged, TLP:CLEAR.

- IP address: `185.181.230[.]71`
- URL: `hxxps://c[.]statcounter[.]com/13139439/0/1ba1a548/1/`
- File hash: `f102d490ad02b1588b9b76664cd715c315eaab33ac22b5d0812c092676242b15`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Update on Attacks by Threat Group APT-C-60](https://blogs.jpcert.or.jp/en/2025/11/APT-C-60_update.html)
- [Attack Exploiting Legitimate Service by APT-C-60](https://blogs.jpcert.or.jp/en/2024/12/APT-C-60.html)
- [APT-C-60 Deploys Updated SpyGlace Malware In Japan Espionage](https://cyble.com/blog/apt-c-60-escalates-spyglace-campaigns-targeting-japan-with-evolved-malware-advanced-evasion-ttps/)
- [APT-C-60 Hackers Exploit StatCounter and Bitbucket in SpyGlace Malware Campaign](https://thehackernews.com/2024/11/apt-c-60-exploits-wps-office.html)
- [DarkHotel: A cluster of groups united by common techniques](https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/darkhotel-a-cluster-of-groups-united-by-common-techniques/)
- [APT-C-60 Attacking Job Seekers to Download Weaponized VHDX File from Google Drive to Steal Sensitive Data](https://cybersecuritynews.com/apt-c-60-attacking-job-seekers/)
- [Attack Group APT-C-60 Targets Japan Using Trusted Platforms](https://www.infosecurity-magazine.com/news/aptc60-targets-japan-using-trusted/)
- [APT-C-60 Campaign: Malicious VHDX Hosted on Google Drive Lures Job Applicants](https://gbhackers.com/apt-c-60-campaign/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2134