# APT-C-60 Spear-Phishing Campaign Against Japanese Organizations Delivering SpyGlace via Proton Drive, LNK/mshta and git.exe

> JPCERT/CC reports 2026 activity by threat group APT-C-60 against organizations in Japan. Spear-phishing emails with Proton Drive links deliver RAR archives containing LNK files that run JavaScript via mshta.exe, fetch components from jsDelivr, GitHub, GitLab and Codeberg, execute scripts with git.exe, and deploy SpyGlace malware (v3.1.15, v3.1.17, v3.1.18).

- **Published:** 2026-10-28T11:39:18Z
- **Last reviewed:** 2026-10-28T11:39:18Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4638
- **ID:** TL-2026-4638
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** APT-C-60 (South Korea)
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

JPCERT/CC published an update on 2026-07-13 describing continued targeted attacks by the threat group APT-C-60 against Japanese organizations. The campaign uses revised initial access tactics and updated infrastructure compared with the activity JPCERT/CC documented in December 2024 and November 2025. No CVE is involved; the chain relies on user execution and abuse of legitimate Windows binaries and public developer/cloud services.

Initial access is spear-phishing. Emails sent from protonmail.com addresses (asako.t1011@protonmail.com, ayuko0328@protonmail.com) carry either a direct attachment or a Proton Drive link from which a RAR archive (for example a Japanese-named archive 具体的内容.rar) is downloaded. The archive contains LNK files (desk.lnk, idx2.lnk, information.lnk, ipo6.lnk, and a Japanese-named LNK). When opened, the LNK copies itself and uses mshta.exe to execute JavaScript embedded in the LNK file.

The embedded JavaScript downloads a file named contributing[1].txt from the jsDelivr CDN (cdn.jsdelivr.net/gh/mei1990789/class125/), searches for, decodes and extracts its content, and then invokes a legitimate git.exe from the extracted folder to execute scripts. The executed script combines TMI*.db component files (TMI003.db, TMI100.db, TMI210.db, TMI320.db, TMI400.db) into a downloader, which retrieves further loaders and the SpyGlace malware from attacker-controlled repositories on GitHub, GitLab and Codeberg. Loader and payload artifacts include iconcache.dat, Cached2014.tmp, Encoded_File.tmp, item.tmp, sdll.tmp, sDll_jj.dll and msdic.log install scripts. The git.exe script-execution and persistence technique was also observed in 2024 and 2025 attacks.

JPCERT/CC observed SpyGlace versions 3.1.15, 3.1.17 and 3.1.18 and reports no major functional differences from earlier versions. Seven C2 IP addresses are listed, along with a StatCounter tracking URL. Attacker repositories hold per-victim records keyed by volume serial number and computer name; JPCERT/CC identified 24 compromised devices from these records. Attribution to a nation-state is not stated in the source. Severity is an analyst assessment; the source gives no CVSS score.

## MITRE ATT&CK

- T1583.006 Web Services
- T1585.002 Email Accounts
- T1608.001 Upload Malware
- T1566.002 Spearphishing Link
- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1218.005 Mshta
- T1218 System Binary Proxy Execution
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1082 System Information Discovery

## Sources

- [Update on Attacks by Threat Group APT-C-60 in 2026 (JPCERT/CC)](https://blogs.jpcert.or.jp/en/2026/07/apt-c-60_2026.html)
- [Update on Attacks by Threat Group APT-C-60 (JPCERT/CC, 2025)](https://blogs.jpcert.or.jp/en/2025/11/APT-C-60_update.html)
- [Attack Exploiting Legitimate Service by APT-C-60 (JPCERT/CC, 2024)](https://blogs.jpcert.or.jp/en/2024/12/APT-C-60.html)
- [APT-C-60 Attack Update for 2026 (SOC Prime)](https://socprime.com/active-threats/apt-c-60-attack-update-for-2026/)
- [APT-C-60 Deploys Updated SpyGlace Malware in Japan (Cyble)](https://cyble.com/blog/apt-c-60-deploys-updated-spyglace-malware-in-japan/)
- [Attack Group APT-C-60 Targets Japan Using Trusted Platforms (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/aptc60-targets-japan-using-trusted/)
- [SpyGlace Attacks Abuse GitHub, GitLab, and Other Trusted Services (VPNCentral)](https://vpncentral.com/spyglace-attacks-abuse-github-gitlab-and-other-trusted-services/)
- [APT-C-60 Abuses GitHub, Proton Drive to Deliver SpyGlace (NetSecOps)](https://dev.to/netsecops_io/apt-c-60-abuses-github-proton-drive-to-deliver-spyglace-3pmj)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4638