APT-C-60 Spear-Phishing Campaign Delivering SpyGlace via Proton Drive, RAR/LNK and Legitimate Developer Services

Key facts

Detection coverage

As of 2026-09-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2371 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: LNK-Initiated mshta.exe Execution with Embedded JavaScript

Detects mshta.exe execution with embedded JavaScript initiated from cmd.exe or explorer.exe, indicative of the APT-C-60 LNK-based delivery chain where opening a malicious LNK file triggers mshta.exe to execute obfuscated JavaScript embedded within the shortcut

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.002, T1204.002, T1218.005, T1059
• Data sources: sysmon, windows_security, microsoft_365_defender
• Severity: high
• Confidence: high

Splunk SPL

index=windows sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| search Image="*\\mshta.exe" CommandLine="*javascript*"
| eval ParentProc = lower(ParentImage)
| search ParentProc="*\\cmd.exe" OR ParentProc="*\\explorer.exe"
| eval lnk_chain = "mshta_via_lnk"
| table _time, Computer, User, ParentImage, Image, CommandLine, CurrentDirectory, lnk_chain
| sort - _time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName == "mshta.exe"
| where ProcessCommandLine contains "javascript"
| where InitiatingProcessFileName in~ ("cmd.exe", "explorer.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath
| order by Timestamp desc

Sigma

title: LNK-Initiated mshta.exe Execution with Embedded JavaScript
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects mshta.exe execution with embedded JavaScript initiated from cmd.exe or explorer.exe, indicative of APT-C-60 LNK-based spear-phishing delivery chain
references:
    - https://blogs.jpcert.or.jp/en/2026/07/apt-c-60_2026.html
    - https://attack.mitre.org/techniques/T1218/005/
author: Threadlinqs Team
date: 2026-09-07
tags:
    - attack.initial_access
    - attack.execution
    - attack.defense_evasion
    - attack.t1566.002
    - attack.t1204.002
    - attack.t1218.005
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_mshta:
        Image|endswith: '\mshta.exe'
        CommandLine|contains: 'javascript'
    selection_parent:
        ParentImage|endswith:
            - '\cmd.exe'
            - '\explorer.exe'
    condition: selection_mshta and selection_parent
falsepositives:
    - Legitimate HTA applications launched from command line for administrative purposes
    - Internal web-based tools using mshta.exe for HTML Application execution
    - Software installers that invoke mshta.exe via command line
level: high

Known false positives:

• Legitimate HTA applications launched from command line
• Administrative scripts using mshta.exe for internal HTML applications

Tuning notes: Exclude known administrative script paths and authorized HTA application directories. Tune baseline by monitoring normal mshta.exe usage patterns in your environment before enabling alerting.

• 🔒 ProtonMail Spear-Phishing with Cloud Storage Link to RAR Delivery · unlock with TL Creds
• 🔒 Git Executable Executed from Non-Standard Path with Script Execution · unlock with TL Creds
• 🔒 SpyGlace C2 Communication with Known C2 Infrastructure and Device Fingerprinting · unlock with TL Creds
• 🔒 RAR Archive Containing LNK Delivered via Email Attachment · unlock with TL Creds
• 🔒 COM Hijacking via InProcServer32 Registry Modification under HKCU · unlock with TL Creds
• 🔒 SpyGlace Backdoor Full Chain: COM Hijacking Persistence with C2 Beaconing · unlock with TL Creds
• 🔒 mshta.exe JavaScript Execution with Outbound CDN Connection to jsDelivr · unlock with TL Creds
• 🔒 Non-Browser Outbound HTTPS to Developer Forges and CDNs from Non-Developer Hosts · unlock with TL Creds

Indicators of compromise

As of 2026-09-07, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-2371.

Sample indicators (3 of 30)

• IP address: 31.58.136[.]207
• URL: hxxps://cdn[.]jsdelivr[.]net/gh/mei1990789/class125/
• File hash: 151b2dc70d141c12a33d8e45a80659fc53a71734e27233326bff150ac87744ea

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

Technical analysis

Final payload is the SpyGlace malware (observed versions v3.1.15, v3.1.17, v3.1.18).

On July 13, 2026, JPCERT/CC published an update reporting that the Chinese-speaking threat group APT-C-60 has continued and modified its spear-phishing campaigns against Japanese organizations (JPCERT/CC had previously documented the group in December 2024 and November 2025). Compared with the 2024-2025 campaigns (VHDX distributed via Google Drive or direct email attachment, executed through a Git binary), the 2026 chain uses a RAR archive containing an LNK file as the delivery vehicle, and the distribution infrastructure has been expanded from GitHub/Bitbucket to also include GitLab, jsDelivr and Codeberg.

The 2026 attack chain begins with a spear-phishing email containing a Proton Drive link that lures the victim into downloading a RAR file (e.g. the Japanese-named archive '具体的内容.rar'). A similar case was confirmed where the malicious file was attached directly to the email without the Proton Drive intermediary. The archive extracts to files including an LNK shortcut (e.g. '利権癒着の具体的内容.lnk', 'desk.lnk', 'idx2.lnk', 'information.lnk', 'ipo6.lnk'). When opened, the LNK copies itself and uses the legitimate Windows binary mshta.exe to execute JavaScript embedded within the LNK file (obfuscated). The embedded JavaScript downloads 'contributing[1].txt' from the jsDelivr CDN, searches for/decodes/extracts the downloaded file, then uses the legitimate git.exe from the extracted folder to execute a script stored in the same folder. The script builds and runs a downloader by combining .db files (e.g. TMI003.db, TMI100.db, TMI210.db, TMI320.db, TMI400.db) extracted from the archive. The downloader then accesses the legitimate developer services GitHub, GitLab, jsDelivr and Codeberg to download and execute additional staged downloaders and loaders, culminating in the SpyGlace backdoor (versions v3.1.15, v3.1.17 and v3.1.18 observed; JPCERT/CC identified no major functional differences compared with earlier versions).

The abuse of legitimate services is deliberate: by using developer-oriented services and CDNs that are often allowed in corporate environments, the actor makes communications and downloads appear to be normal access, making detection/blocking by destination alone difficult. Infrastructure recovered from the campaign includes seven C2 IPs, the jsDelivr URL cdn.jsdelivr.net/gh/mei1990789/class125/ (referencing the attacker repository github.com/mei1990789/class125), a StatCounter tracking URL, 18 attacker-managed GitHub repositories, 8 GitLab repositories, 3 Codeberg repositories, two ProtonMail sender addresses, commit-log email addresses, and over a hundred SHA256 hashes across the downloader/loader/LNK/JS/RAR stages. Downloaders identify victimized devices by a <volume serial number>@<computer name> string (e.g. 1510781397@DESKTOP-CJU6TU7), which also appears in StatCounter referrer values and GitHub retrieval filenames.

SpyGlace is APT-C-60's custom backdoor. Prior JPCERT/CC analysis (2024-2025) documented that C2 communication uses BASE64 plus a modified RC4 variant (increased KSA cycles with an added XOR value) and that downloaded files are decrypted with AES-128-CBC; the initial C2 request carries MD5 hashes of the userid string 'GOLDBAR' and system identifiers, together with RC4-encrypted device data (ComputerName, UserName, CpuInfo, OS version, SpyGlace version). The malware implements a large command set including download/upload, screenupload/screenauto (screenshots), procspawn, diskinfo, ld, attach/detach, cmd, and the newer 'uld' (loads a module function then unloads it), with prockill/proclist reduced to no-ops in recent versions. Persistence is achieved via COM hijacking (registry InProcServer32 values under HKCU CLSIDs such as {566296fe-e0e8-475f-ba9c-a31ad31620b1}), a technique observed across the 2024, 2025 and 2026 campaigns.

Attribution: JPCERT/CC attributes the campaigns to APT-C-60, a group that has primarily targeted Japan and other East Asian regions (decoy documents suggest Japan, South Korea and China) by impersonating job seekers contacting recruitment/HR staff. Positive Technologies analyzed the same SpyGlace variant (naming it 'GoldBar' after the deobfuscated userid$$$$GOLDBAR string) and concluded that APT-C-60 and APT-Q-12 belong to the DarkHotel cluster; JPCERT/CC confirmed the GOLDBAR userid matches Positive Technologies' DarkHotel reporting. ESET and ThreatBook CTI published independent analyses of SpyGlace, including ESET's disclosure that an earlier 2024 APT-C-60 campaign exploited the WPS Office zero-days CVE-2024-7262/CVE-2024-7263 to deliver the backdoor.

Impact and defense: SpyGlace is a full espionage backdoor capable of file exfiltration, screenshots and remote command execution over encrypted C2, enabling credential and document theft from affected organizations. Because the campaign abuses legitimate services and standard Windows functionality (mshta.exe, git.exe, COM hijacking), JPCERT/CC emphasizes that blocking by communication destination alone is insufficient. Defenders should hunt LNK->mshta.exe->script-download chains, git.exe/gcmd.exe script execution from unusual paths, registry modifications to COM CLSID InProcServer32 values, outbound HTTPS to developer services/CDNs from non-developer hosts, and block the published C2 IPs, repository URLs, sender addresses and file hashes. No CVE or CVSS applies to this campaign; all indicators are grounded in the verified JPCERT/CC report and supporting vendor research.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027.013 Encrypted/Encoded File; T1140 Deobfuscate/Decode Files or Information; T1218.005 Mshta

Execution

T1059 Command and Scripting Interpreter; T1204.001 Malicious Link; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1102.002 Bidirectional Communication; T1573.001 Symmetric Cryptography

Discovery

T1082 System Information Discovery

Collection

T1113 Screen Capture

Persistence

T1546.011 Application Shimming

Initial Access

T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link

Remediation

Patches

• No CVE applies to this 2026 campaign; keep WPS Office and Windows patched as a control against the related APT-C-60 WPS Office zero-day exploitation (CVE-2024-7262 / CVE-2024-7263)

Immediate actions

• Block the seven published SpyGlace C2 IPs (31.58.136.207, 154.18.239.209, 173.234.11.141, 185.18.222.241, 213.111.158.200/201/216) at the perimeter
• Block/quarantine the listed attacker GitHub, GitLab and Codeberg repository URLs, the jsDelivr URL cdn.jsdelivr.net/gh/mei1990789/class125/ and the StatCounter tracking URL
• Block the two ProtonMail sender addresses (asako.t1011@protonmail.com, ayuko0328@protonmail.com) at the email gateway
• Quarantine files matching the published SHA256 hashes (RAR, LNK, JS, downloader/loader stages, SpyGlace payloads) via EDR/file-blocking
• Hunt for victimized-device identifiers (volume serial number@computer name) in proxy/StatCounter logs to identify compromised hosts

Workarounds

• Disable or restrict mshta.exe if not business-required
• Block RAR/LNK delivery and double-click execution from email-downloaded archives where possible
• Restrict non-engineering hosts from reaching public git forges and CDN services

Longer-term hardening

• Deploy EDR behavioral detections for LNK -> mshta.exe -> script download chains and mshta.exe executing embedded/obfuscated JavaScript
• Alert on git.exe/gcmd.exe executing scripts from non-standard paths (Living-off-the-Land)
• Monitor and alert on registry modifications under HKCU Software\Classes\CLSID\...\InProcServer32 (COM hijacking persistence)
• Monitor outbound HTTPS to developer forges and CDNs (GitHub, GitLab, Bitbucket, Codeberg, jsDelivr) and statcounter.com from non-developer/HR hosts
• Maintain email-user awareness of job-seeker/recruitment-themed spear-phishing and cloud-storage links

Affected and fixed versions

• Microsoft — Windows (mshta.exe)
  Vulnerable versions: All supported Windows versions (mshta.exe present by default)
• Git — Git for Windows (git.exe)
  Vulnerable versions: All versions (abused as a Living-off-the-Land script executor)

Timeline

• 2024-08-01 First confirmed APT-C-60 attack against a Japanese organization (August 2024): job-applicant impersonation email with a Google Drive VHDX download link executed via LNK + git.exe, documented by JPCERT/CC.
• 2024-09-01 Security vendors publish analyses of the SpyGlace backdoor (August-September 2024): ESET links APT-C-60 exploitation of WPS Office zero-days CVE-2024-7262/7263 to SpyGlace delivery; ThreatBook CTI documents SpyGlace v3.0 attacks on South Korean HR/trade entities.
• 2024-09-05 Positive Technologies attributes the SpyGlace RAT variant 'GoldBar' (userid$$$$GOLDBAR) to APT-C-60 and concludes APT-C-60 and APT-Q-12 belong to the DarkHotel cluster.
• 2024-12-11 JPCERT/CC publishes its first APT-C-60 report detailing the VHDX/LNK/git.exe chain, COM-hijacking persistence (CLSIDs F82B4EF1-93A9-4DDE-8015-F7950A1A6E31 and 7849596a-48ea-486e-8937-a2a3009f31a9), StatCounter tracking, and SpyGlace v3.1.6.
• 2025-06-27 SpyGlace v3.1.12 build uploaded to the attacker's GitHub repository (infrastructure shifting from Bitbucket to GitHub).
• 2025-07-03 SpyGlace v3.1.13 build uploaded to the attacker's GitHub repository.
• 2025-07-16 SpyGlace v3.1.14 build uploaded to the attacker's GitHub repository.
• 2025-08-01 2025 attacks on recruitment staff observed June-August 2025; malicious VHDX attached directly to emails; new 'uld' command added; prockill/proclist modified to no-ops.
• 2025-11-05 JPCERT/CC publishes the 2025 update: SpyGlace v3.1.12-3.1.14, BASE64 + modified RC4 C2 and AES-128-CBC downloads, 'GOLDBAR' userid matching Positive Technologies' DarkHotel reporting.
• 2026-07-13 JPCERT/CC publishes the 2026 update (basis of this threat): Proton Drive RAR/LNK + mshta.exe + obfuscated JavaScript + git.exe chain; distribution infrastructure expanded to GitHub, GitLab, jsDelivr and Codeberg; SpyGlace v3.1.15, v3.1.17 and v3.1.18 observed.

Sources cited

• Update on Attacks by Threat Group APT-C-60 in 2026 JPCERT/CC · Advisory · 2026-07-13
• Attack Exploiting Legitimate Service by APT-C-60 JPCERT/CC · Advisory · 2024-12-11
• Update on Attacks by Threat Group APT-C-60 JPCERT/CC · Advisory · 2025-11-05
• ESET Research: Spy group exploits WPS Office zero-day, analysis uncovers a second vulnerability eset.com · Research · 2024-08-19
• Analysis of APT-C-60 Attack on South Korea (SpyGlace v3.0) threatbook.io · Research · 2024-09-01
• DarkHotel. A cluster of groups united by common techniques global.ptsecurity.com · Research · 2024-09-05
• APT-C-60 Deploys Updated SpyGlace Malware In Japan Espionage cyble.com · Blog · 2025-10-01
• APT-C-60 hackers exploited WPS Office zero-day to deploy SpyGlace malware BleepingComputer · News · 2024-08-20
• Spear-Phishing Campaign Uses Proton Drive Links and LNK Files to Deliver SpyGlace gbhackers.com · News · 2026-07-13

Related threats

• APT-C-60 Spear-Phishing Campaign Against Japanese Organizations Delivering SpyGlace via Proton Drive, LNK/mshta and git.exe

Related coverage of this activity

• APT-C-60 Japanese Recruiter Lure

More from APT-C-60

• NSFOCUS Monthly APT Insights August 2026: Lazarus MISTPEN/ForestTiger/RelayShell Campaign with CVE-2026-68820, UAC-0099 LUNCHPOKE/BURNYBEAR/MATCHBOIL.V2, CVE-2026-42897 Exchange OWA Exploitation
• APT-C-60 Update: SpyGlace Campaign via VHDX Spear-Phishing Targeting Recruitment Staff in Japan/East Asia
• SpyGlace Malware Campaign by APT-C-60 (Naikon) Abuses Trusted Developer Services (GitHub, GitLab, jsDelivr, Codeberg, Bitbucket) to Target Japan
• APT-C-60 Spear-Phishing Campaign Deploying SpyGlace Spyware (v3.1.12-3.1.14) via VHDX/LNK and Git (gcmd.exe) LOLBin Abuse

Previous and next in malware

• REVSTEALER (REF2859): Emerging Windows infostealer with App-Bound encryption bypass, Polygon blockchain C2, and gaming-focused social engineering Previous report
• PEEP: Chromium Toolkit Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution Next report