Threat reportAPTTL-2026-4638
APT-C-60 Spear-Phishing Campaign Against Japanese Organizations Delivering SpyGlace via Proton Drive, LNK/mshta and git.exe
APT-C-60 Spear-Phishing Campaign Against Japanese (TL-2026-4638), also tracked as SpyGlace campaign, is a high-severity advanced persistent threat campaign, first published 2026-10-28. It is attributed to APT-C-60 (South Korea) with low confidence, affects Microsoft Windows, maps to 12 MITRE ATT&CK techniques (T1027, T1059.007, T1082), and is covered by 9 detection rules and 27 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 12MITRE ATT&CK
- Actors
- 1APT-C-60
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-4638
- Threat ID
- TL-2026-4638
- Also known as
- SpyGlace campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- APT-C-60
- Attribution confidence
- LOW
- Nation-state nexus
- South Korea
- Motivation
- UNKNOWN
- Target sectors
- government administration, private sector organizations in japan
- Target regions
- japan
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in APT-C-60 Spear-Phishing Campaign Against Japanese
Malware and tooling: SpyGrace
How APT-C-60 Spear-Phishing Campaign Against Japanese works
JPCERT/CC reports 2026 activity by threat group APT-C-60 against organizations in Japan. Spear-phishing emails with Proton Drive links deliver RAR archives containing LNK files that run JavaScript via mshta.exe, fetch components from jsDelivr, GitHub, GitLab and Codeberg, execute scripts with git.exe, and deploy SpyGlace malware (v3.1.15, v3.1.17, v3.1.18).
JPCERT/CC published an update on 2026-07-13 describing continued targeted attacks by the threat group APT-C-60 against Japanese organizations. The campaign uses revised initial access tactics and updated infrastructure compared with the activity JPCERT/CC documented in December 2024 and November 2025. No CVE is involved; the chain relies on user execution and abuse of legitimate Windows binaries and public developer/cloud services.
Initial access is spear-phishing. Emails sent from protonmail.com addresses (asako.t1011@protonmail.com, ayuko0328@protonmail.com) carry either a direct attachment or a Proton Drive link from which a RAR archive (for example a Japanese-named archive 具体的内容.rar) is downloaded. The archive contains LNK files (desk.lnk, idx2.lnk, information.lnk, ipo6.lnk, and a Japanese-named LNK). When opened, the LNK copies itself and uses mshta.exe to execute JavaScript embedded in the LNK file.
The embedded JavaScript downloads a file named contributing[1].txt from the jsDelivr CDN (cdn.jsdelivr.net/gh/mei1990789/class125/), searches for, decodes and extracts its content, and then invokes a legitimate git.exe from the extracted folder to execute scripts. The executed script combines TMI*.db component files (TMI003.db, TMI100.db, TMI210.db, TMI320.db, TMI400.db) into a downloader, which retrieves further loaders and the SpyGlace malware from attacker-controlled repositories on GitHub, GitLab and Codeberg. Loader and payload artifacts include iconcache.dat, Cached2014.tmp, Encoded_File.tmp, item.tmp, sdll.tmp, sDll_jj.dll and msdic.log install scripts. The git.exe script-execution and persistence technique was also observed in 2024 and 2025 attacks.
JPCERT/CC observed SpyGlace versions 3.1.15, 3.1.17 and 3.1.18 and reports no major functional differences from earlier versions. Seven C2 IP addresses are listed, along with a StatCounter tracking URL. Attacker repositories hold per-victim records keyed by volume serial number and computer name; JPCERT/CC identified 24 compromised devices from these records. Attribution to a nation-state is not stated in the source. Severity is an analyst assessment; the source gives no CVSS score.
MITRE ATT&CK techniques used in TL-2026-4638
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1218.005 Mshta
Execution
T1059.007 JavaScript; T1204.002 Malicious File
Discovery
T1082 System Information Discovery
Initial Access
T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Resource Development
T1583.006 Web Services; T1585.002 Email Accounts; T1608.001 Upload Malware
Affected products and versions in APT-C-60 Spear-Phishing Campaign Against Japanese
- Microsoft — Windows
Vulnerable versions: Windows endpoints able to run LNK files, mshta.exe and git.exe
Remediation for APT-C-60 Spear-Phishing Campaign Against Japanese
Immediate actions
- Block the listed C2 IP addresses (31.58.136.207, 154.18.239.209, 173.234.11.141, 185.18.222.241, 213.111.158.200, 213.111.158.201, 213.111.158.216) at the perimeter and hunt for historical connections
- Search mail logs for the sender addresses asako.t1011@protonmail.com and ayuko0328@protonmail.com and for Proton Drive links delivered to users
- Hunt for LNK files launching mshta.exe and for git.exe running from temporary or unusual folders
- Search endpoints for the listed file hashes and for requests to cdn.jsdelivr.net/gh/mei1990789/class125/ and c.statcounter.com/13178005/
Workarounds
- Block execution of mshta.exe where not required
- Block or quarantine RAR archives containing LNK files at the mail gateway
- Remove git.exe from endpoints that do not need it, or restrict it with application control
Longer-term hardening
- Train users not to open cloud-storage links in suspicious emails or LNK files inside archives such as RAR
- Log mshta.exe and git.exe command lines and parent processes and alert on anomalies
- Restrict or monitor access to GitHub, GitLab, Codeberg and jsDelivr from non-developer endpoints
Timeline of APT-C-60 Spear-Phishing Campaign Against Japanese
- JPCERT/CC publishes 'Attack Exploiting Legitimate Service by APT-C-60' (December 2024; day not stated). The git.exe script-execution and persistence technique is observed in 2024 attacks.
- JPCERT/CC publishes an update on APT-C-60 (November 2025; day not stated) covering SpyGlace versions 3.1.12, 3.1.13 and 3.1.14 seen in Q3 2025, abusing GitHub, StatCounter and Git.
- SOC Prime publishes detection-oriented coverage of the campaign recommending alerts on LNK files launching mshta.exe and git.exe running from temporary or unusual folders.
- JPCERT/CC reports 24 compromised devices identified from volume serial numbers and computer names stored in attacker repositories.
- JPCERT/CC lists seven C2 IPs, two phishing sender addresses, attacker repositories on GitHub, GitLab and Codeberg, and SHA256 hashes of LNK, JavaScript, loader and SpyGlace files.
- JPCERT/CC publishes 'Update on Attacks by Threat Group APT-C-60 in 2026' describing spear-phishing with Proton Drive links, LNK/mshta.exe execution, jsDelivr and git.exe use, and SpyGlace v3.1.15, v3.1.17 and v3.1.18.
Sources cited for APT-C-60 Spear-Phishing Campaign Against Japanese
- Update on Attacks by Threat Group APT-C-60 in 2026 (JPCERT/CC)
- Update on Attacks by Threat Group APT-C-60 (JPCERT/CC, 2025)
- Attack Exploiting Legitimate Service by APT-C-60 (JPCERT/CC, 2024)
- APT-C-60 Attack Update for 2026 (SOC Prime)
- APT-C-60 Deploys Updated SpyGlace Malware in Japan (Cyble)
- Attack Group APT-C-60 Targets Japan Using Trusted Platforms (Infosecurity Magazine)
- SpyGlace Attacks Abuse GitHub, GitLab, and Other Trusted Services (VPNCentral)
- APT-C-60 Abuses GitHub, Proton Drive to Deliver SpyGlace (NetSecOps)
Detection coverage for TL-2026-4638
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4638 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.