# APT-C-60 Spear-Phishing Campaign Delivering SpyGlace via Proton Drive, RAR/LNK and Legitimate Developer Services

> JPCERT/CC continues to observe APT-C-60 spear-phishing attacks targeting organizations in Japan, with several changes in initial access techniques and attack infrastructure. The 2026 chain: a spear-phishing email lures the victim via a Proton Drive link to download a RAR file containing an LNK file; opening the LNK executes mshta.exe with obfuscated JavaScript embedded in the LNK, which uses a legitimate git.exe to run scripts that build and execute staged downloaders and loaders served via GitHub, GitLab, jsDelivr and Codeberg. Final payload is the SpyGlace malware (observed versions v3.1.15, v3.1.17, v3.1.18).

- **Published:** 2026-09-07T00:00:00Z
- **Last reviewed:** 2026-09-07T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2371
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-apt-c-60-proton-drive-spyglace-tl-2026-2371.webp?v=af613fed (Threadlinqs threat intel: APT-C-60 Proton Drive SpyGlace Campaign: Detection & IOCs (TL-2026-2371) — High severity, 30 IOCs, 9 detection rules.)
- **ID:** TL-2026-2371
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** APT-C-60 (South Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)
- **CVEs:** CVE-2024-7262, CVE-2024-7263

## Description

On July 13, 2026, JPCERT/CC published an update reporting that the Chinese-speaking threat group APT-C-60 has continued and modified its spear-phishing campaigns against Japanese organizations (JPCERT/CC had previously documented the group in December 2024 and November 2025). Compared with the 2024-2025 campaigns (VHDX distributed via Google Drive or direct email attachment, executed through a Git binary), the 2026 chain uses a RAR archive containing an LNK file as the delivery vehicle, and the distribution infrastructure has been expanded from GitHub/Bitbucket to also include GitLab, jsDelivr and Codeberg.

The 2026 attack chain begins with a spear-phishing email containing a Proton Drive link that lures the victim into downloading a RAR file (e.g. the Japanese-named archive '具体的内容.rar'). A similar case was confirmed where the malicious file was attached directly to the email without the Proton Drive intermediary. The archive extracts to files including an LNK shortcut (e.g. '利権癒着の具体的内容.lnk', 'desk.lnk', 'idx2.lnk', 'information.lnk', 'ipo6.lnk'). When opened, the LNK copies itself and uses the legitimate Windows binary mshta.exe to execute JavaScript embedded within the LNK file (obfuscated). The embedded JavaScript downloads 'contributing[1].txt' from the jsDelivr CDN, searches for/decodes/extracts the downloaded file, then uses the legitimate git.exe from the extracted folder to execute a script stored in the same folder. The script builds and runs a downloader by combining .db files (e.g. TMI003.db, TMI100.db, TMI210.db, TMI320.db, TMI400.db) extracted from the archive. The downloader then accesses the legitimate developer services GitHub, GitLab, jsDelivr and Codeberg to download and execute additional staged downloaders and loaders, culminating in the SpyGlace backdoor (versions v3.1.15, v3.1.17 and v3.1.18 observed; JPCERT/CC identified no major functional differences compared with earlier versions).

The abuse of legitimate services is deliberate: by using developer-oriented services and CDNs that are often allowed in corporate environments, the actor makes communications and downloads appear to be normal access, making detection/blocking by destination alone difficult. Infrastructure recovered from the campaign includes seven C2 IPs, the jsDelivr URL cdn.jsdelivr.net/gh/mei1990789/class125/ (referencing the attacker repository github.com/mei1990789/class125), a StatCounter tracking URL, 18 attacker-managed GitHub repositories, 8 GitLab repositories, 3 Codeberg repositories, two ProtonMail sender addresses, commit-log email addresses, and over a hundred SHA256 hashes across the downloader/loader/LNK/JS/RAR stages. Downloaders identify victimized devices by a <volume serial number>@<computer name> string (e.g. 1510781397@DESKTOP-CJU6TU7), which also appears in StatCounter referrer values and GitHub retrieval filenames.

SpyGlace is APT-C-60's custom backdoor. Prior JPCERT/CC analysis (2024-2025) documented that C2 communication uses BASE64 plus a modified RC4 variant (increased KSA cycles with an added XOR value) and that downloaded files are decrypted with AES-128-CBC; the initial C2 request carries MD5 hashes of the userid string 'GOLDBAR' and system identifiers, together with RC4-encrypted device data (ComputerName, UserName, CpuInfo, OS version, SpyGlace version). The malware implements a large command set including download/upload, screenupload/screenauto (screenshots), procspawn, diskinfo, ld, attach/detach, cmd, and the newer 'uld' (loads a module function then unloads it), with prockill/proclist reduced to no-ops in recent versions. Persistence is achieved via COM hijacking (registry InProcServer32 values under HKCU CLSIDs such as {566296fe-e0e8-475f-ba9c-a31ad31620b1}), a technique observed across the 2024, 2025 and 2026 campaigns.

Attribution: JPCERT/CC attributes the campaigns to APT-C-60, a group that has primarily targeted Japan and other East Asian regions (decoy documents suggest Japan, South Korea and China) by impersonating job seekers contacting recruitment/HR staff. Positive Technologies analyzed the same SpyGlace variant (naming it 'GoldBar' after the deobfuscated userid$$$$GOLDBAR string) and concluded that APT-C-60 and APT-Q-12 belong to the DarkHotel cluster; JPCERT/CC confirmed the GOLDBAR userid matches Positive Technologies' DarkHotel reporting. ESET and ThreatBook CTI published independent analyses of SpyGlace, including ESET's disclosure that an earlier 2024 APT-C-60 campaign exploited the WPS Office zero-days CVE-2024-7262/CVE-2024-7263 to deliver the backdoor.

Impact and defense: SpyGlace is a full espionage backdoor capable of file exfiltration, screenshots and remote command execution over encrypted C2, enabling credential and document theft from affected organizations. Because the campaign abuses legitimate services and standard Windows functionality (mshta.exe, git.exe, COM hijacking), JPCERT/CC emphasizes that blocking by communication destination alone is insufficient. Defenders should hunt LNK->mshta.exe->script-download chains, git.exe/gcmd.exe script execution from unusual paths, registry modifications to COM CLSID InProcServer32 values, outbound HTTPS to developer services/CDNs from non-developer hosts, and block the published C2 IPs, repository URLs, sender addresses and file hashes. No CVE or CVSS applies to this campaign; all indicators are grounded in the verified JPCERT/CC report and supporting vendor research.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1566.001 Spearphishing Attachment
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1059 Command and Scripting Interpreter
- T1218.005 Mshta
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1546.011 Application Shimming
- T1082 System Information Discovery
- T1113 Screen Capture
- T1102.002 Bidirectional Communication
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**LNK-Initiated mshta.exe Execution with Embedded JavaScript** (`TL-2026-2371-SPL-001`)

Detects mshta.exe execution with embedded JavaScript initiated from cmd.exe or explorer.exe, indicative of the APT-C-60 LNK-based delivery chain where opening a malicious LNK file triggers mshta.exe to execute obfuscated JavaScript embedded within the shortcut

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.002, T1204.002, T1218.005, T1059
- **Data sources:** sysmon, windows_security, microsoft_365_defender
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=windows sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| search Image="*\\mshta.exe" CommandLine="*javascript*"
| eval ParentProc = lower(ParentImage)
| search ParentProc="*\\cmd.exe" OR ParentProc="*\\explorer.exe"
| eval lnk_chain = "mshta_via_lnk"
| table _time, Computer, User, ParentImage, Image, CommandLine, CurrentDirectory, lnk_chain
| sort - _time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName == "mshta.exe"
| where ProcessCommandLine contains "javascript"
| where InitiatingProcessFileName in~ ("cmd.exe", "explorer.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath
| order by Timestamp desc
```

### Sigma

```yaml
title: LNK-Initiated mshta.exe Execution with Embedded JavaScript
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects mshta.exe execution with embedded JavaScript initiated from cmd.exe or explorer.exe, indicative of APT-C-60 LNK-based spear-phishing delivery chain
references:
    - https://blogs.jpcert.or.jp/en/2026/07/apt-c-60_2026.html
    - https://attack.mitre.org/techniques/T1218/005/
author: Threadlinqs Team
date: 2026-09-07
tags:
    - attack.initial_access
    - attack.execution
    - attack.defense_evasion
    - attack.t1566.002
    - attack.t1204.002
    - attack.t1218.005
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_mshta:
        Image|endswith: '\mshta.exe'
        CommandLine|contains: 'javascript'
    selection_parent:
        ParentImage|endswith:
            - '\cmd.exe'
            - '\explorer.exe'
    condition: selection_mshta and selection_parent
falsepositives:
    - Legitimate HTA applications launched from command line for administrative purposes
    - Internal web-based tools using mshta.exe for HTML Application execution
    - Software installers that invoke mshta.exe via command line
level: high
```

**Known false positives:**

- Legitimate HTA applications launched from command line
- Administrative scripts using mshta.exe for internal HTML applications

**Tuning notes:** Exclude known administrative script paths and authorized HTA application directories. Tune baseline by monitoring normal mshta.exe usage patterns in your environment before enabling alerting.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ProtonMail Spear-Phishing with Cloud Storage Link to RAR Delivery (locked: unlock with TL Creds)
- Git Executable Executed from Non-Standard Path with Script Execution (locked: unlock with TL Creds)
- SpyGlace C2 Communication with Known C2 Infrastructure and Device Fingerprinting (locked: unlock with TL Creds)
- RAR Archive Containing LNK Delivered via Email Attachment (locked: unlock with TL Creds)
- COM Hijacking via InProcServer32 Registry Modification under HKCU (locked: unlock with TL Creds)
- SpyGlace Backdoor Full Chain: COM Hijacking Persistence with C2 Beaconing (locked: unlock with TL Creds)
- mshta.exe JavaScript Execution with Outbound CDN Connection to jsDelivr (locked: unlock with TL Creds)
- Non-Browser Outbound HTTPS to Developer Forges and CDNs from Non-Developer Hosts (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- IP address: `31.58.136[.]207`
- URL: `hxxps://cdn[.]jsdelivr[.]net/gh/mei1990789/class125/`
- File hash: `151b2dc70d141c12a33d8e45a80659fc53a71734e27233326bff150ac87744ea`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Update on Attacks by Threat Group APT-C-60 in 2026](https://blogs.jpcert.or.jp/en/2026/07/apt-c-60_2026.html)
- [Attack Exploiting Legitimate Service by APT-C-60](https://blogs.jpcert.or.jp/en/2024/12/APT-C-60.html)
- [Update on Attacks by Threat Group APT-C-60](https://blogs.jpcert.or.jp/en/2025/11/APT-C-60_update.html)
- [ESET Research: Spy group exploits WPS Office zero-day, analysis uncovers a second vulnerability](https://www.eset.com/us/about/newsroom/research/eset-research-spy-group-exploits-wps-office-zero-day-analysis-uncovers-a-second-vulnerability/)
- [Analysis of APT-C-60 Attack on South Korea (SpyGlace v3.0)](https://threatbook.io/blog/Analysis-of-APT-C-60-Attack-on-South-Korea)
- [DarkHotel. A cluster of groups united by common techniques](https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/darkhotel-a-cluster-of-groups-united-by-common-techniques/)
- [APT-C-60 hackers exploited WPS Office zero-day to deploy SpyGlace malware](https://www.bleepingcomputer.com/news/security/apt-c-60-hackers-exploited-wps-office-zero-day-to-deploy-spyglace-malware/)
- [APT-C-60 Deploys Updated SpyGlace Malware In Japan Espionage](https://cyble.com/apt-c-60-deploys-updated-spyglace-malware-in-japan/)
- [Spear-Phishing Campaign Uses Proton Drive Links and LNK Files to Deliver SpyGlace](https://gbhackers.com/spear-phishing-uses-proton-drive/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2371