# APT-C-60 Update: SpyGlace Campaign via VHDX Spear-Phishing Targeting Recruitment Staff in Japan/East Asia

> JPCERT/CC reports that APT-C-60 sent spear-phishing emails with job-seeker lures and malicious VHDX attachments to recruitment staff in Japan and East Asia between June and August 2025. An LNK inside the VHDX runs the legitimate Git binary gcmd.exe to execute a script, which installs a downloader that persists via COM hijacking and retrieves the SpyGlace backdoor (3.1.12, 3.1.13, 3.1.14) using GitHub, Bitbucket and statcounter.

- **Published:** 2026-10-17T21:48:09Z
- **Last reviewed:** 2026-10-17T21:48:09Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3843
- **ID:** TL-2026-3843
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** APT-C-60 (South Korea)
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-7262, CVE-2024-7263

## Description

JPCERT/CC (author Yuma Masubuchi, 2025-11-05) documents an update to attacks by the threat group APT-C-60 observed between June and August 2025. The lure is a spear-phishing email impersonating a job seeker and aimed at recruitment department staff. Earlier campaigns directed victims to download a VHDX from Google Drive; in this wave the malicious VHDX (CV & Professional Experience.vhdx) is attached directly to the email. Mounting a virtual disk image is a known way to avoid Mark-of-the-Web protections.

Execution chain: the victim opens Resume.rtf.lnk from the mounted VHDX. The LNK launches gcmd.exe, a legitimate Git binary shipped inside the image (P:\LICENSES.LOG\mingw64\bin\gcmd.exe), with a command of the form 'cd .\LICENSES.LOG\mingw64\bin && type glog.txt | gcmd.exe'. The glog.txt script displays a decoy resume and drops 'Downloader1' as WebClassUser.dat. Downloader1 is registered for persistence through COM hijacking (HKCU\Software\Classes\CLSID\{566296fe-e0e8-475f-ba9c-a31ad31620b1}\InProcServer32; CLSID {64B8F404-A4AE-11D1-B7B6-00C04FB926AF} is also noted) so it is loaded by a legitimate process.

Downloader1 beacons to attacker-controlled GitHub repositories (pattern https://raw.githubusercontent.com/<user>/class2025/refs/heads/main/<VolumeSerialNumber+ComputerName>.txt), with the victim identifier carried in Referer headers. Operators place per-victim files containing commands: '1*' modifies the request interval, '0_' or '40_' resets intervals, and 'http*' downloads a DLL. A statcounter.com tracker is also abused. Legacy infrastructure used Bitbucket (clouds999/glo29839 downloads). A second-stage downloader ('Downloader2') retrieves and executes SpyGlace. Encrypted downloads are staged at %temp%\wcts66889.tmp.

SpyGlace versions 3.1.12 (uploaded to GitHub 2025-06-27), 3.1.13 (2025-07-03) and 3.1.14 (2025-07-16) were identified. Command set: turn on, turn off, cd, ddir, ddel, ld, uld (new: unload module after function execution), attach, detach, procspawn, prockill and proclist (both disabled), diskinfo, download, downfree, cancel, screenupload (output path updated to %LocalAppData%\Microsoft\Windows\Clouds\Clouds.db), screenauto and upload. C2 registration uses parameters a001 (md5 of 'GOLDBAR'), a002 (md5 of systeminfo), a003 ('uid' or 'info') and a004 (Base64 of custom-RC4 data) against ASP endpoints on 185.181.230.71 (/wkdo9/4b3ru.asp, t1802.asp, n3tb4.asp, 2qpmk.asp). Download-command crypto is AES-128-CBC, with RC4 and XOR layers elsewhere. Mutexes K31610KIO9834PG79A90B, K31610KIO9834PG79AD7B and K31610KIO9834PG79A44A were observed. Install paths moved from %public%\AccountPictures\Default\ (pre-3.1.14) to %appdata%\Microsoft\SystemCertificates\My\CPLs (3.1.14+).

Background: ESET (August 2024) described APT-C-60 as a South Korea-aligned espionage group targeting East Asia that exploited WPS Office for Windows (CVE-2024-7262, with CVE-2024-7263 found during analysis) to deliver SpyGlace. Chuangyu 404 Lab and Positive Technologies have assessed APT-C-60 and APT-Q-12 (Pseudo Hunter) as sub-groups of the DarkHotel cluster. CVE-2024-7262/7263 are not used in this 2025 VHDX campaign per the JPCERT/CC report; the source states no CVE or CVSS for this activity.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059 Command and Scripting Interpreter
- T1218 System Binary Proxy Execution
- T1553.005 Mark-of-the-Web Bypass
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1112 Modify Registry
- T1546.015 Component Object Model Hijacking
- T1102.002 Bidirectional Communication
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1129 Shared Modules
- T1082 System Information Discovery
- T1057 Process Discovery
- T1113 Screen Capture
- T1005 Data from Local System
- T1583.006 Web Services

## Sources

- [Update on Attacks by Threat Group APT-C-60 (JPCERT/CC)](https://blogs.jpcert.or.jp/en/2025/11/APT-C-60_update.html)
- [ESET Research: Spy group exploits WPS Office zero day; analysis uncovers a second vulnerability](https://blog.eset.ie/2024/08/30/eset-research-spy-group-exploits-wps-office-zero-day-analysis-uncovers-a-second-vulnerability/)
- [APT group exploits WPS Office for Windows RCE vulnerability (CVE-2024-7262) - Help Net Security](https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/)
- [APT-C-60 Exploits WPS Office / SpyGlace Backdoor - The Hacker News](https://thehackernews.com/2024/11/apt-c-60-exploits-wps-office.html)
- [APT-C-60 deploys updated SpyGlace malware in Japan - Cyble](https://cyble.com/blog/apt-c-60-deploys-updated-spyglace-malware-in-japan/)
- [Attack Exploiting Legitimate Service by APT-C-60 (JPCERT/CC)](https://blogs.jpcert.or.jp/en/2024/12/APT-C-60.html)
- [Update on Attacks by Threat Group APT-C-60 in 2026 (JPCERT/CC)](https://blogs.jpcert.or.jp/en/2026/07/apt-c-60_2026.html)
- [Resume with a surprise: APT-C-60 hackers 'apply for jobs' at Japanese companies - SecurityLab.ru](https://www.securitylab.ru/news/565945.php)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3843