APT-C-60 refreshes SpyGlace loader chain
APT-C-60 continues spear-phishing Japanese recruiters with VHDX attachments that deploy updated SpyGlace malware via GitHub and statcounter for C2.
Sourceblogs.jpcert.or.jp — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
JPCERT/CC reports continued activity by APT-C-60 between June and August 2025, targeting Japanese recruitment staff with spear-phishing emails impersonating job applicants. Unlike prior campaigns that used Google Drive links, the group now attaches malicious VHDX files directly to emails; opening the embedded LNK triggers a legitimate Git binary (gcmd.exe) to execute a hidden script that drops a decoy document and a first-stage downloader (WebClassUser.dat), persisted via COM hijacking.
The downloader chain has been updated to fingerprint victims using volume serial number and computer name, check in with the legitimate analytics service statcounter.com, and retrieve second-stage payload locations from attacker-controlled files hosted on a GitHub repository (carolab989/class2025). This second downloader retrieves and executes the SpyGlace backdoor and its loader, both using updated XOR/ADD-based API resolution and COM hijacking for persistence. JPCERT/CC identified three SpyGlace builds (3.1.12–3.1.14) with modified commands, a new 'uld' module-unload function, and changed persistence paths, alongside a distinct C2 protocol combining BASE64 and a modified RC4 cipher with the identifying string 'GOLDBAR' previously linked to this actor.
The campaign shows continuity with APT-C-60 operations observed in 2024 and overlaps in TTPs with a separate overseas campaign reported in September 2025, though infrastructure does not overlap, suggesting parallel or forked operations. The reliance on legitimate services (Git, GitHub, statcounter) for staging and C2 complicates detection and reflects deliberate operational security by the group.
Mentioned in this report
Detection guidance
Git Binary Executing Hidden Script from VHDX/LNK
A behavioural hunt for the technique in general.
Git executable (gcmd.exe) spawned from Explorer or file-open handler context, executing script or binary from temporary/hidden location - typical of malicious LNK abuse. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Git Binary Executing Hidden Script from VHDX/LNK
description: Detects gcmd.exe (Git) spawning with command-line arguments that execute
scripts or binaries, often preceded by VHDX or LNK file access. This pattern indicates
malicious use of legitimate Git binary to proxy execution of embedded payloads.
tags:
- attack.stealth
- attack.t1218
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \\gcmd.exe
CommandLine|contains:
- -c
- cmd.exe
- .bat
- .vbs
- .ps1
filter_legitimate_git:
ParentImage|endswith:
- \\cmd.exe
- \\powershell.exe
CommandLine|contains: clone
condition: selection and not filter_legitimate_git
falsepositives:
- Development environments using Git for legitimate script execution
- Custom build automation tools invoking gcmd.exe with local scripts
level: high
id: 17cf7883-9991-5ed2-837b-b06b3d542973
status: experimental
author: Vorant
COM Hijacking Registry Modification for Persistence
A behavioural hunt for the technique in general.
Registry write to HKLM/HKCU COM InprocServer32 or LocalServer32 keys with values pointing to unusual executables or DLLs dropped by recent process. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: COM Hijacking Registry Modification for Persistence
description: Detects suspicious registry modifications to COM InprocServer32 or LocalServer32
paths, particularly when targeting CLSIDs or ProgIDs not associated with Windows
defaults. Typical persistence mechanism for SpyGlace and similar loaders.
tags:
- attack.persistence
- attack.t1546.015
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains:
- InprocServer32
- LocalServer32
Details|contains:
- .dat
- \\Temp\\
- \\AppData\\Local\\
- powershell
- cmd.exe
filter_windows_com:
Details|contains:
- System32
- SysWOW64
TargetObject|contains:
- Microsoft.Windows
- '{0002DF01-0000'
condition: selection and not filter_windows_com
falsepositives:
- Custom application installers registering COM components in user AppData
- Software deployment tools modifying COM registry hives
level: high
id: 8a68e2c8-fdd5-5505-8b5b-0d8e44d31fda
status: experimental
author: Vorant
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://blogs.jpcert.or.jp/en/2025/11/APT-C-60_update.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs