Loading story…
Kaspersky reported new activity involving the LODEINFO malware family, a fileless espionage tool previously linked to APT10, in attacks against organizations in Japan. The campaign used several updated infection chains, including malicious Word documents with VBA macros, self-extracting RAR archives that abused DLL sideloading, and a newly identified downloader shellcode called DOWNIISSA that deployed LODEINFO v0.6.5. Lures used Japanese-language decoys and filenames tied to political and media themes, indicating targeting of government, ruling-party-related, and media entities.
Researchers observed multiple LODEINFO variants, including v0.5.9, v0.6.3, and v0.6.5, alongside changes to loaders and payload delivery. Those updates included the use of external encrypted BLOB files and obfuscated export-based payload reconstruction, showing continued efforts to complicate analysis and evade detection. The findings indicate that the operators are actively refining tooling and tradecraft in response to public reporting, reinforcing LODEINFO's role as an adaptive cyber-espionage platform focused on Japanese targets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
ITOCHU Cyber & Intelligence published research on LODEINFO variants spanning versions 0.6.6 through 0.7.3, documenting continued evolution of the malware associated with APT10. The post indicates the campaign and tooling remained active and developed further after the 2021 Kaspersky findings.
Kaspersky released a report detailing the newly observed LODEINFO activity and concluding that the operators continuously adapt their tooling and TTPs, likely in response to public security research. The publication reinforced LODEINFO's role as an evolving cyber-espionage platform.
The report documents LODEINFO variants v0.5.9, v0.6.3, and v0.6.5, along with loader changes such as external encrypted BLOB files and obfuscated export-based payload reconstruction. These findings indicate continued evolution of the malware and its execution chain.
The researchers newly identified a downloader shellcode named DOWNIISSA in the observed campaign. It was used to deploy LODEINFO version 0.6.5.
Kaspersky identified another infection chain using self-extracting RAR archives that abused DLL sideloading to execute malware. This showed the operators expanding and varying their delivery techniques.
One infection chain described in the report used malicious Microsoft Word documents containing VBA macros to initiate compromise. This reflects one of the delivery methods used in the observed LODEINFO activity.
Kaspersky observed LODEINFO used in espionage activity primarily against organizations in Japan, including government, ruling-party-related, and media entities. The attackers used Japanese-language decoys and politically themed filenames to support the targeting.
The report states that earlier public research had already linked the LODEINFO malware family to the APT10 threat actor. This established the attribution context for later activity analyzed in the report.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
blog-en.itochuci.co.jp
Open sourcesecurelist.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
APT-C-60 has conducted a targeted espionage campaign against organizations in Japan, utilizing spear-phishing emails that impersonate job seekers to deliver malicious payloads. The attackers attach a VHDX file containing an LNK shortcut, which, when executed, leverages legitimate tools such as Git to run malicious scripts. These scripts deploy the SpyGlace malware, which establishes persistence through COM hijacking and communicates with external services for device identification and command-and-control. The campaign demonstrates a shift from using cloud storage links to directly attaching malicious files, and incorporates updates to the downloader and SpyGlace components, including new encoding and communication methods. Analysis by JPCERT/CC and other sources highlights the use of GitHub for tasking, the evolution of the malware's infection flow, and the use of decoy documents to mask malicious activity. The attackers have refined their techniques to evade detection and maintain long-term access, with the malware periodically contacting legitimate statistics services as part of its operation. The campaign underscores the persistent threat posed by APT-C-60 and the sophistication of their tooling and delivery methods targeting Japanese entities.
Jun 29, 2026
A spear-phishing campaign targeted Japanese organizations with HR-themed lures impersonating company representatives and delivered a multi-stage malware chain built around **PXDropper**, the **PoisonX** kernel driver, and the modular **10FXRAT** remote-access trojan. Victims were directed to Google Cloud Storage-hosted archives containing ZIP, RAR, LNK, or EXE payloads, including polyglot Windows shortcut files that dropped decoy Japanese PDFs and used obfuscated downloaders to fetch second-stage malware such as `RuntimeBroker.exe`. The operators also disguised payloads as legitimate Feishu/Lark and Baidu Netdisk installers and abused DLL sideloading with signed binaries including `dashost.exe` and `unregmp2.exe` to decrypt and launch the malware. Once installed, PoisonX used kernel-level capabilities to terminate security tools and conceal malicious processes and network traffic, while 10FXRAT provided remote shell access, SOCKS5 tunneling, persistence, plugin-based expansion, and tampering with Microsoft Defender. Researchers said the activity continued into May and expanded to Chinese organizations, with the operators shifting from a signed PoisonX driver to **BYOVD** techniques using legitimately signed but vulnerable drivers such as **ASUSTeK `EneIo64.sys`** and Microsoft **`procexp.sys`**. The campaign exposed at least 61 indicators, including 49 SHA-256 hashes and 12 IPv4 command-and-control addresses; notable infrastructure included the Google Cloud Storage bucket `opentokenaiit`, the URL `https://storage.googleapis.com/opentokenaiit/newgram.exe`, and C2 address `101.32.190.202`. Researchers assessed the tradecraft as consistent with a China-nexus operation, with one report noting a possible but unconfirmed link to **Silver Fox**.
Jun 29, 2026
JPCERT/CC reported that **APT-C-60** continued targeting organizations in Japan with spear-phishing campaigns that shifted initial access tactics while retaining heavy abuse of legitimate online services. In observed intrusions, phishing emails either linked victims to **Proton Drive** or carried malicious archive attachments, including RAR files containing **`.lnk`** shortcuts. When opened, the LNK files launched **`mshta.exe`** to execute embedded JavaScript, beginning a multi-stage infection chain designed to blend into normal enterprise traffic. The JavaScript retrieved and decoded additional components from services including **jsDelivr**, then used a legitimate **`git.exe`** binary to run scripts and assemble downloaders from **`.db`** files before fetching more payloads from **GitHub**, **GitLab**, **Codeberg**, and other trusted platforms. JPCERT/CC said the final malware delivered was **SpyGlace**, with versions **v3.1.15**, **v3.1.17**, and **v3.1.18** observed, and published related indicators including C2 infrastructure, malicious file hashes, phishing sender addresses, and attacker repository details. The agency noted that combining standard Windows tools with trusted cloud, developer, and CDN services makes the activity harder to detect.
Jul 13, 2026