Loading story…
APT-C-60 has conducted a targeted espionage campaign against organizations in Japan, utilizing spear-phishing emails that impersonate job seekers to deliver malicious payloads. The attackers attach a VHDX file containing an LNK shortcut, which, when executed, leverages legitimate tools such as Git to run malicious scripts. These scripts deploy the SpyGlace malware, which establishes persistence through COM hijacking and communicates with external services for device identification and command-and-control. The campaign demonstrates a shift from using cloud storage links to directly attaching malicious files, and incorporates updates to the downloader and SpyGlace components, including new encoding and communication methods.
Analysis by JPCERT/CC and other sources highlights the use of GitHub for tasking, the evolution of the malware's infection flow, and the use of decoy documents to mask malicious activity. The attackers have refined their techniques to evade detection and maintain long-term access, with the malware periodically contacting legitimate statistics services as part of its operation. The campaign underscores the persistent threat posed by APT-C-60 and the sophistication of their tooling and delivery methods targeting Japanese entities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On November 5, 2025, JPCERT/CC published an updated report on APT-C-60 attacks in Japan, detailing the VHDX/LNK infection chain, Downloader1 and Downloader2 behavior, COM hijacking persistence, GitHub-based tasking, and extensive file and network indicators. The report also analyzed attacker GitHub repositories and highlighted consistent use of the 'GOLDBAR' userid marker in communications.
JPCERT/CC documented SpyGlace versions 3.1.12, 3.1.13, and 3.1.14 during the June-August 2025 activity. The updates included command changes such as no-op behavior for prockill/proclist, a new uld command, and changes to mutexes and auto-execution paths in version 3.1.14.
During the 2025 campaign, JPCERT/CC found the attackers had moved their tasking and staging workflow from Bitbucket to GitHub while keeping broadly consistent tradecraft. Downloader components derived victim-specific filenames from the volume serial number and computer name, then retrieved tasking from attacker-controlled GitHub repositories.
JPCERT/CC observed continued APT-C-60 activity in Japan from June through August 2025 targeting recruitment staff with spear-phishing emails impersonating job seekers. The campaign delivered VHDX attachments containing an LNK that launched a legitimate Git binary to run embedded scripts and begin a multi-stage infection chain.
Public reporting cited in the references describes an APT-C-60 espionage incident in Japan around August 2024 using a job-application lure. The attack delivered a cloud-hosted VHDX with a decoy and malicious LNK, abused services including Google Drive, StatCounter, and Bitbucket, and established persistence via COM hijacking before deploying SpyGlace.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourceforesiet.com
Open sourceblogs.jpcert.or.jp
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
JPCERT/CC reported that **APT-C-60** continued targeting organizations in Japan with spear-phishing campaigns that shifted initial access tactics while retaining heavy abuse of legitimate online services. In observed intrusions, phishing emails either linked victims to **Proton Drive** or carried malicious archive attachments, including RAR files containing **`.lnk`** shortcuts. When opened, the LNK files launched **`mshta.exe`** to execute embedded JavaScript, beginning a multi-stage infection chain designed to blend into normal enterprise traffic. The JavaScript retrieved and decoded additional components from services including **jsDelivr**, then used a legitimate **`git.exe`** binary to run scripts and assemble downloaders from **`.db`** files before fetching more payloads from **GitHub**, **GitLab**, **Codeberg**, and other trusted platforms. JPCERT/CC said the final malware delivered was **SpyGlace**, with versions **v3.1.15**, **v3.1.17**, and **v3.1.18** observed, and published related indicators including C2 infrastructure, malicious file hashes, phishing sender addresses, and attacker repository details. The agency noted that combining standard Windows tools with trusted cloud, developer, and CDN services makes the activity harder to detect.
Jul 13, 2026
Kaspersky reported new activity involving the **LODEINFO** malware family, a fileless espionage tool previously linked to **APT10**, in attacks against organizations in Japan. The campaign used several updated infection chains, including malicious Word documents with VBA macros, self-extracting RAR archives that abused **DLL sideloading**, and a newly identified downloader shellcode called **DOWNIISSA** that deployed `LODEINFO v0.6.5`. Lures used Japanese-language decoys and filenames tied to political and media themes, indicating targeting of government, ruling-party-related, and media entities. Researchers observed multiple LODEINFO variants, including `v0.5.9`, `v0.6.3`, and `v0.6.5`, alongside changes to loaders and payload delivery. Those updates included the use of external encrypted BLOB files and obfuscated export-based payload reconstruction, showing continued efforts to complicate analysis and evade detection. The findings indicate that the operators are actively refining tooling and tradecraft in response to public reporting, reinforcing LODEINFO's role as an adaptive cyber-espionage platform focused on Japanese targets.
Jun 29, 2026
A spear-phishing campaign targeted Japanese organizations with HR-themed lures impersonating company representatives and delivered a multi-stage malware chain built around **PXDropper**, the **PoisonX** kernel driver, and the modular **10FXRAT** remote-access trojan. Victims were directed to Google Cloud Storage-hosted archives containing ZIP, RAR, LNK, or EXE payloads, including polyglot Windows shortcut files that dropped decoy Japanese PDFs and used obfuscated downloaders to fetch second-stage malware such as `RuntimeBroker.exe`. The operators also disguised payloads as legitimate Feishu/Lark and Baidu Netdisk installers and abused DLL sideloading with signed binaries including `dashost.exe` and `unregmp2.exe` to decrypt and launch the malware. Once installed, PoisonX used kernel-level capabilities to terminate security tools and conceal malicious processes and network traffic, while 10FXRAT provided remote shell access, SOCKS5 tunneling, persistence, plugin-based expansion, and tampering with Microsoft Defender. Researchers said the activity continued into May and expanded to Chinese organizations, with the operators shifting from a signed PoisonX driver to **BYOVD** techniques using legitimately signed but vulnerable drivers such as **ASUSTeK `EneIo64.sys`** and Microsoft **`procexp.sys`**. The campaign exposed at least 61 indicators, including 49 SHA-256 hashes and 12 IPv4 command-and-control addresses; notable infrastructure included the Google Cloud Storage bucket `opentokenaiit`, the URL `https://storage.googleapis.com/opentokenaiit/newgram.exe`, and C2 address `101.32.190.202`. Researchers assessed the tradecraft as consistent with a China-nexus operation, with one report noting a possible but unconfirmed link to **Silver Fox**.
Jun 29, 2026