JPCERT/CC Eyes

In our previous two blog posts (Dec 2024, Nov 2025), we discussed attacks carried out by APT-C-60 against organizations in Japan. JPCERT/CC has continued to observe similar attack activity. In the attacks covered in this article, we observed several changes in the initial access techniques and attack infrastructure used by the threat actor. This article focuses on the attack flow of APT-C-60 activity observed in 2026.

Initial Access Method

Figure 1 shows the overall attack flow. In the case we observed, the spear-phishing email contained a Proton Drive link, which was used to lure the victim into downloading a RAR file from Proton Drive. When the RAR file is extracted, it contains files including an LNK file. Once the victim opens the LNK file, the subsequent infection process is executed. We have also confirmed a similar case in which the malicious file was attached directly to the email, without using Proton Drive as an intermediary.

Behavior of the LNK File

When executed, the LNK file used during the infection copies itself and then uses mshta.exe to execute JavaScript embedded within the LNK file. As shown in Figure 2, the LNK file contains JavaScript code, which is called after the LNK file is executed. This allows the threat actor to use a legitimate Windows program while carrying out processes that lead to the retrieval and execution of subsequent payloads.

Figure 3 shows the infection flow after the LNK file is executed. Although the JavaScript code embedded in the LNK file is obfuscated, it performs the following main functions:

• Downloads the file contributing[1].txt from jsDelivr
• Searches for, decodes, and extracts the downloaded contributing[1].txt file
• Uses the legitimate git.exe located in the extracted folder to execute a script in the same folder

Figure 4 shows the executed script. The script creates and executes a downloader by combining .db files located in the extracted folder. The downloader accesses legitimate sites such as GitHub, downloads additional downloaders and loaders, and executes them. The technique of executing scripts using git.exe, as well as the persistence method, was also observed in attacks in 2024 and 2025, and the same techniques were used in this attack. For details, please refer to our previous two articles (Dec 2024, Nov 2025).

Legitimate Services Used as Attack Infrastructure

As in previous cases, multiple legitimate services were used as access destinations for the executed downloader. In the 2025 attacks, GitHub and Bitbucket were used. However, in the 2026 attacks, we confirmed that GitLab, jsDelivr, and Codeberg, in addition to GitHub, were abused as attack infrastructure. By using legitimate services, the threat actor may be attempting to make communications and downloads appear to be normal access. In particular, developer-oriented services and CDNs are often allowed in corporate environments, which makes it difficult to detect or block the activity based solely on the communication destination. The downloader ultimately downloads and executes malware called SpyGlace from these legitimate services. In this attack, we observed SpyGlace versions v3.1.15, v3.1.17, and v3.1.18, but did not identify any major functional differences compared with earlier versions.

In Conclusion

In the SpyGlace attack observed in this case, we confirmed the use of Proton Drive for file distribution, an LNK file contained in a RAR archive, JavaScript execution via mshta.exe, and the abuse of legitimate services such as GitHub, GitLab, jsDelivr, and Codeberg. These attacks may be difficult to detect because they abuse legitimate services and standard Windows functionality. Users should remain vigilant and avoid opening cloud storage links in suspicious emails or LNK files contained in archives such as RAR files. The IoCs, including the C2 servers and file hashes we confirmed, are listed in the Appendix.

Yuma Masubuch
(This article was machine-translated and manually reviewed.)

Appendix A: Network IoCs (SpyGlace C2 Infrastructure)

• 31.58.136[.]207
• 154.18.239[.]209
• 173.234.11[.]141
• 185.18.222[.]241
• 213.111.158[.]200
• 213.111.158[.]201
• 213.111.158[.]216

Appendix B: URLs of Legitimate Services Used by the Attacker

• https[:]//c.statcounter[.]com/13178005/0/7f3c2735/1/
• https[:]//cdn.jsdelivr[.]net/gh/mei1990789/class125/

Appendix C: IoC Files

Appendix D: Spear-Phishing Email Senders

asako.t1011@protonmail.com
ayuko0328@protonmail.com

Appendix E: Attacker Management Repository

https[:]//github[.]com/mei1990789/class125
https[:]//github[.]com/sapphire679/tblsesarol/
https[:]//github[.]com/sapphire689/dnaluakxit
https[:]//github[.]com/wanib11399/zjeqopmfit
https[:]//github[.]com/cafes39636/ngwtaepesf
https[:]//github[.]com/rapefo2905/rncprjmauw
https[:]//github[.]com/hexif45133/yedkatinrc
https[:]//github[.]com/jewexo9791/archibkyof
https[:]//github[.]com/lowege1212/izrtysherg
https[:]//github[.]com/gixop88415/glfhvhtzih
https[:]//github[.]com/kapap40675/fpqtzyofdl
https[:]//github[.]com/cefobe3574/kojyyvtkqo
https[:]//github[.]com/vogenoc114/qlofnsayvl
https[:]//github[.]com/bohihef411/tuikfwoveb
https[:]//github[.]com/waxiyes819/dymcdbqqen
https[:]//github[.]com/fehijow850/uywcrcvlnb
https[:]//github[.]com/yefixi3890/krbgqbmlho
https[:]//github[.]com/williams250666/bluenote554
https[:]//gitlab[.]com/sapphire689/dnaluakxit
https[:]//gitlab[.]com/cafes39636/ngwtaepesf
https[:]//gitlab[.]com/rapefo2905/yedkatinrc
https[:]//gitlab[.]com/lowege1212/eboralfotj
https[:]//gitlab[.]com/kapap40675/fpqtzyofdl
https[:]//gitlab[.]com/vogenoc114/qlofnsayvl
https[:]//gitlab[.]com/waxiyes819/dymcdbqqen
https[:]//gitlab[.]com/yefixi3890/krbgqbmlho
https[:]//codeberg[.]org/ochi_ma992/3tv9239irfn83
https[:]//codeberg[.]org/meca922199/ertlokefgpokjper2359
https[:]//codeberg[.]org/Hamilton385673/eff88e889w33456

Appendix F: Email Addresses Used for Commits

sapphire679@proton.me
sapphire689@proton.me
meimei91@protonmail.com
rapefo2905@outlook.com
jewexo9791@outlook.com
legDevMachine@protonmail.com

Appendix G: Victimized Devices Identified from the GitHub Repository (Volume Serial Number and Computer Name)

1510781397@DESKTOP-CJU6TU7
1785033524@2024NOTEBOOK
2264373920@DESKTOP-S9E6ADG
2419945818@BD1
2428126365@SDI-WIN
242922728@DESKTOP-5K5ICQ5
2590771213@DESKTOP-LAVUNRP
317267226@DESKTOP-V1R49JC
3290476432@DESKTOP-J734R21
3362573326@DESKTOP-43R2GH0
3386414762@DESKTOP-MKV3QN0
3629482019@DESKTOP-8UM79S5
3704188960@DESKTOP-D1Q1I0J
3836479251@ADMIN-PC
409023259@JAY-PC
4127454498@DANY-LAPTOP
4166053503@LAPTOP-JHA4UD2S
582552893@LV
1409377236@DESKTOP-6OND78S
2283291050@DESKTOP-9CPEB4D
2590772946@DESKTOP-GL14J4L
3159231749@DESKTOP-SS0PND9
4166214414@DESKTOP-B9JE10V
840033591@DESKTOP-DBNHUR7