Loading story…
JPCERT/CC reported that APT-C-60 continued targeting organizations in Japan with spear-phishing campaigns that shifted initial access tactics while retaining heavy abuse of legitimate online services. In observed intrusions, phishing emails either linked victims to Proton Drive or carried malicious archive attachments, including RAR files containing .lnk shortcuts. When opened, the LNK files launched mshta.exe to execute embedded JavaScript, beginning a multi-stage infection chain designed to blend into normal enterprise traffic.
The JavaScript retrieved and decoded additional components from services including jsDelivr, then used a legitimate git.exe binary to run scripts and assemble downloaders from .db files before fetching more payloads from GitHub, GitLab, Codeberg, and other trusted platforms. JPCERT/CC said the final malware delivered was SpyGlace, with versions v3.1.15, v3.1.17, and v3.1.18 observed, and published related indicators including C2 infrastructure, malicious file hashes, phishing sender addresses, and attacker repository details. The agency noted that combining standard Windows tools with trusted cloud, developer, and CDN services makes the activity harder to detect.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
In the July 13, 2026 update, JPCERT/CC disclosed technical details from the 2026 campaign, including observed SpyGlace versions v3.1.15, v3.1.17, and v3.1.18, along with C2 infrastructure, malicious file hashes, phishing sender addresses, and attacker repository indicators.
On July 13, 2026, JPCERT/CC reported ongoing APT-C-60 attacks against organizations in Japan during 2026. The update described changes in initial access and infrastructure, including spear-phishing via Proton Drive links or malicious archives with LNK files that ultimately deployed SpyGlace.
On December 11, 2024, JPCERT/CC published a report on attacks by APT-C-60 that exploited legitimate services, establishing the earlier campaign later used as a comparison point for 2026 activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcemalware.news
Open sourceblogs.jpcert.or.jp
Open sourceblogs.jpcert.or.jp
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
APT-C-60 has conducted a targeted espionage campaign against organizations in Japan, utilizing spear-phishing emails that impersonate job seekers to deliver malicious payloads. The attackers attach a VHDX file containing an LNK shortcut, which, when executed, leverages legitimate tools such as Git to run malicious scripts. These scripts deploy the SpyGlace malware, which establishes persistence through COM hijacking and communicates with external services for device identification and command-and-control. The campaign demonstrates a shift from using cloud storage links to directly attaching malicious files, and incorporates updates to the downloader and SpyGlace components, including new encoding and communication methods. Analysis by JPCERT/CC and other sources highlights the use of GitHub for tasking, the evolution of the malware's infection flow, and the use of decoy documents to mask malicious activity. The attackers have refined their techniques to evade detection and maintain long-term access, with the malware periodically contacting legitimate statistics services as part of its operation. The campaign underscores the persistent threat posed by APT-C-60 and the sophistication of their tooling and delivery methods targeting Japanese entities.
Jun 29, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
A spear-phishing campaign targeted Japanese organizations with HR-themed lures impersonating company representatives and delivered a multi-stage malware chain built around **PXDropper**, the **PoisonX** kernel driver, and the modular **10FXRAT** remote-access trojan. Victims were directed to Google Cloud Storage-hosted archives containing ZIP, RAR, LNK, or EXE payloads, including polyglot Windows shortcut files that dropped decoy Japanese PDFs and used obfuscated downloaders to fetch second-stage malware such as `RuntimeBroker.exe`. The operators also disguised payloads as legitimate Feishu/Lark and Baidu Netdisk installers and abused DLL sideloading with signed binaries including `dashost.exe` and `unregmp2.exe` to decrypt and launch the malware. Once installed, PoisonX used kernel-level capabilities to terminate security tools and conceal malicious processes and network traffic, while 10FXRAT provided remote shell access, SOCKS5 tunneling, persistence, plugin-based expansion, and tampering with Microsoft Defender. Researchers said the activity continued into May and expanded to Chinese organizations, with the operators shifting from a signed PoisonX driver to **BYOVD** techniques using legitimately signed but vulnerable drivers such as **ASUSTeK `EneIo64.sys`** and Microsoft **`procexp.sys`**. The campaign exposed at least 61 indicators, including 49 SHA-256 hashes and 12 IPv4 command-and-control addresses; notable infrastructure included the Google Cloud Storage bucket `opentokenaiit`, the URL `https://storage.googleapis.com/opentokenaiit/newgram.exe`, and C2 address `101.32.190.202`. Researchers assessed the tradecraft as consistent with a China-nexus operation, with one report noting a possible but unconfirmed link to **Silver Fox**.
Jun 29, 2026