Threat reportAPTTL-2026-3843
APT-C-60 Update: SpyGlace Campaign via VHDX Spear-Phishing Targeting Recruitment Staff in Japan/East Asia
APT-C-60 Update (TL-2026-3843), also tracked as APT-C-60 SpyGlace campaign, is a high-severity advanced persistent threat campaign, first published 2026-10-17. It is attributed to APT-C-60 (South Korea) with low confidence, affects Microsoft Windows (endpoints of recruitment staff; VHDX mounting and, references 2 CVEs (CVE-2024-7262, CVE-2024-7263), maps to 19 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 19MITRE ATT&CK
- Actors
- 1APT-C-60
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-3843
- Threat ID
- TL-2026-3843
- Also known as
- APT-C-60 SpyGlace campaign, SpyGlace
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- APT-C-60
- Attribution confidence
- LOW
- Nation-state nexus
- South Korea
- Motivation
- ESPIONAGE
- Target sectors
- recruitment human resources, general enterprise
- Target regions
- japan, East Asia
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in APT-C-60 Update
Malware and tooling: SpyGrace
How APT-C-60 Update works
JPCERT/CC reports that APT-C-60 sent spear-phishing emails with job-seeker lures and malicious VHDX attachments to recruitment staff in Japan and East Asia between June and August 2025. An LNK inside the VHDX runs the legitimate Git binary gcmd.exe to execute a script, which installs a downloader that persists via COM hijacking and retrieves the SpyGlace backdoor (3.1.12, 3.1.13, 3.1.14) using GitHub, Bitbucket and statcounter.
JPCERT/CC (author Yuma Masubuchi, 2025-11-05) documents an update to attacks by the threat group APT-C-60 observed between June and August 2025. The lure is a spear-phishing email impersonating a job seeker and aimed at recruitment department staff. Earlier campaigns directed victims to download a VHDX from Google Drive; in this wave the malicious VHDX (CV & Professional Experience.vhdx) is attached directly to the email. Mounting a virtual disk image is a known way to avoid Mark-of-the-Web protections.
Execution chain: the victim opens Resume.rtf.lnk from the mounted VHDX. The LNK launches gcmd.exe, a legitimate Git binary shipped inside the image (P:\LICENSES.LOG\mingw64\bin\gcmd.exe), with a command of the form 'cd .\LICENSES.LOG\mingw64\bin && type glog.txt | gcmd.exe'. The glog.txt script displays a decoy resume and drops 'Downloader1' as WebClassUser.dat. Downloader1 is registered for persistence through COM hijacking (HKCU\Software\Classes\CLSID\{566296fe-e0e8-475f-ba9c-a31ad31620b1}\InProcServer32; CLSID {64B8F404-A4AE-11D1-B7B6-00C04FB926AF} is also noted) so it is loaded by a legitimate process.
Downloader1 beacons to attacker-controlled GitHub repositories (pattern https://raw.githubusercontent.com/<user>/class2025/refs/heads/main/<VolumeSerialNumber+ComputerName>.txt), with the victim identifier carried in Referer headers. Operators place per-victim files containing commands: '1*' modifies the request interval, '0_' or '40_' resets intervals, and 'http*' downloads a DLL. A statcounter.com tracker is also abused. Legacy infrastructure used Bitbucket (clouds999/glo29839 downloads). A second-stage downloader ('Downloader2') retrieves and executes SpyGlace. Encrypted downloads are staged at %temp%\wcts66889.tmp.
SpyGlace versions 3.1.12 (uploaded to GitHub 2025-06-27), 3.1.13 (2025-07-03) and 3.1.14 (2025-07-16) were identified. Command set: turn on, turn off, cd, ddir, ddel, ld, uld (new: unload module after function execution), attach, detach, procspawn, prockill and proclist (both disabled), diskinfo, download, downfree, cancel, screenupload (output path updated to %LocalAppData%\Microsoft\Windows\Clouds\Clouds.db), screenauto and upload. C2 registration uses parameters a001 (md5 of 'GOLDBAR'), a002 (md5 of systeminfo), a003 ('uid' or 'info') and a004 (Base64 of custom-RC4 data) against ASP endpoints on 185.181.230.71 (/wkdo9/4b3ru.asp, t1802.asp, n3tb4.asp, 2qpmk.asp). Download-command crypto is AES-128-CBC, with RC4 and XOR layers elsewhere. Mutexes K31610KIO9834PG79A90B, K31610KIO9834PG79AD7B and K31610KIO9834PG79A44A were observed. Install paths moved from %public%\AccountPictures\Default\ (pre-3.1.14) to %appdata%\Microsoft\SystemCertificates\My\CPLs (3.1.14+).
Background: ESET (August 2024) described APT-C-60 as a South Korea-aligned espionage group targeting East Asia that exploited WPS Office for Windows (CVE-2024-7262, with CVE-2024-7263 found during analysis) to deliver SpyGlace. Chuangyu 404 Lab and Positive Technologies have assessed APT-C-60 and APT-Q-12 (Pseudo Hunter) as sub-groups of the DarkHotel cluster. CVE-2024-7262/7263 are not used in this 2025 VHDX campaign per the JPCERT/CC report; the source states no CVE or CVSS for this activity.
MITRE ATT&CK techniques used in TL-2026-3843
Collection
T1005 Data from Local System; T1113 Screen Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution
Discovery
T1057 Process Discovery; T1082 System Information Discovery
Execution
T1059 Command and Scripting Interpreter; T1129 Shared Modules; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1102.002 Bidirectional Communication; T1573.001 Symmetric Cryptography
defense-impairment
T1112 Modify Registry; T1553.005 Mark-of-the-Web Bypass
Persistence
T1546.015 Component Object Model Hijacking
Initial Access
T1566.001 Spearphishing Attachment
Resource Development
Affected products and versions in APT-C-60 Update
- Microsoft — Windows (endpoints of recruitment staff; VHDX mounting and COM hijacking abused)
Vulnerable versions: Not version-specific; behavioral abuse of built-in features
Remediation for APT-C-60 Update
Patches
- No CVE is exploited in this campaign per the source; keep WPS Office patched against CVE-2024-7262 and CVE-2024-7263 (used in earlier APT-C-60 activity)
Immediate actions
- Block and alert on outbound access to 185.181.230.71 and on raw.githubusercontent.com requests for the listed repositories (carolab989, football2025, fenchiuwu, Ridgley223870 r834829jf, goldbars33 ozbdkak33) and bitbucket.org/clouds999/glo29839
- Hunt for gcmd.exe launched from a mounted VHDX drive letter or from LICENSES.LOG\mingw64\bin
- Hunt for the listed file hashes, mutexes, and the WebClassUser.dat / UsrClassCache.dat / Clouds.db artifacts
- Check HKCU\Software\Classes\CLSID for InProcServer32 entries under {566296fe-e0e8-475f-ba9c-a31ad31620b1} and {64B8F404-A4AE-11D1-B7B6-00C04FB926AF}
- Quarantine inbound email with .vhdx/.vhd/.iso attachments sent to recruitment/HR mailboxes
Workarounds
- Disable mounting of VHDX files via Group Policy or file-association changes where not required
- Block gcmd.exe/Git binaries executing from non-standard paths with application control
Longer-term hardening
- Block or strip VHDX/VHD/ISO attachments at the mail gateway and restrict automatic mounting of disk images for standard users
- Alert on LNK files executing binaries from newly mounted volumes
- Monitor HKCU CLSID InProcServer32 creation by non-installer processes
- Train recruitment staff on resume-themed spear-phishing with disk-image attachments
- Apply egress controls or proxy inspection for abuse of GitHub, Bitbucket and statcounter by non-developer endpoints
CVEs associated with APT-C-60 Update
Timeline of APT-C-60 Update
- Public reporting that APT-C-60 exploited WPS Office for Windows (CVE-2024-7262) to deliver the SpyGlace backdoor; ESET published its analysis on 2024-08-30.
- JPCERT/CC publishes 'Attack Exploiting Legitimate Service by APT-C-60' on an August 2024 incident: job-applicant spear-phishing with a Google Drive link to a VHDX, SpyGlace v3.1.6, Bitbucket/StatCounter abuse and COM hijacking persistence.
- SpyGlace 3.1.12 uploaded to the attacker GitHub repository (14:33:28 JST); campaign window runs June-August 2025.
- SpyGlace 3.1.13 uploaded to GitHub (18:25:18 JST).
- SpyGlace 3.1.14 uploaded to GitHub (15:03:52 JST); install path moves to %appdata%\Microsoft\SystemCertificates\My\CPLs.
- JPCERT/CC publishes 'Update on Attacks by Threat Group APT-C-60' with IOCs, GitHub repository analysis and SpyGlace changes.
- JPCERT/CC publishes a further update on the same campaign: Proton Drive links delivering RAR archives with LNKs, mshta.exe-run JavaScript, GitLab/jsDelivr/Codeberg abuse alongside GitHub, and SpyGlace v3.1.15, v3.1.17 and v3.1.18.
Sources cited for APT-C-60 Update
- Update on Attacks by Threat Group APT-C-60 (JPCERT/CC)
- ESET Research: Spy group exploits WPS Office zero day; analysis uncovers a second vulnerability
- APT group exploits WPS Office for Windows RCE vulnerability (CVE-2024-7262) - Help Net Security
- APT-C-60 Exploits WPS Office / SpyGlace Backdoor - The Hacker News
- APT-C-60 deploys updated SpyGlace malware in Japan - Cyble
- Attack Exploiting Legitimate Service by APT-C-60 (JPCERT/CC)
- Update on Attacks by Threat Group APT-C-60 in 2026 (JPCERT/CC)
- Resume with a surprise: APT-C-60 hackers 'apply for jobs' at Japanese companies - SecurityLab.ru
Detection coverage for TL-2026-3843
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3843 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.