APT-C-60 refreshes SpyGlace loader chain

5 November 2025 routine threat

APT-C-60 continues spear-phishing Japanese recruiters with VHDX attachments that deploy updated SpyGlace malware via GitHub and statcounter for C2.

JPCERT/CC reports continued activity by APT-C-60 between June and August 2025, targeting Japanese recruitment staff with spear-phishing emails impersonating job applicants. Unlike prior campaigns that used Google Drive links, the group now attaches malicious VHDX files directly to emails; opening the embedded LNK triggers a legitimate Git binary (gcmd.exe) to execute a hidden script that drops a decoy document and a first-stage downloader (WebClassUser.dat), persisted via COM hijacking.

The downloader chain has been updated to fingerprint victims using volume serial number and computer name, check in with the legitimate analytics service statcounter.com, and retrieve second-stage payload locations from attacker-controlled files hosted on a GitHub repository (carolab989/class2025). This second downloader retrieves and executes the SpyGlace backdoor and its loader, both using updated XOR/ADD-based API resolution and COM hijacking for persistence. JPCERT/CC identified three SpyGlace builds (3.1.12–3.1.14) with modified commands, a new 'uld' module-unload function, and changed persistence paths, alongside a distinct C2 protocol combining BASE64 and a modified RC4 cipher with the identifying string 'GOLDBAR' previously linked to this actor.

The campaign shows continuity with APT-C-60 operations observed in 2024 and overlaps in TTPs with a separate overseas campaign reported in September 2025, though infrastructure does not overlap, suggesting parallel or forked operations. The reliance on legitimate services (Git, GitHub, statcounter) for staging and C2 complicates detection and reflects deliberate operational security by the group.

Mentioned in this report

Threat actors Darkhotel

Malware Downloader1Downloader2SpyGlace

Detection guidance

Git Binary Executing Hidden Script from VHDX/LNK

ATT&CK T1218

Git executable (gcmd.exe) spawned from Explorer or file-open handler context, executing script or binary from temporary/hidden location - typical of malicious LNK abuse. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Git Binary Executing Hidden Script from VHDX/LNK
description: Detects gcmd.exe (Git) spawning with command-line arguments that execute
  scripts or binaries, often preceded by VHDX or LNK file access. This pattern indicates
  malicious use of legitimate Git binary to proxy execution of embedded payloads.
tags:
- attack.defense-evasion
- attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \\gcmd.exe
    CommandLine|contains:
    - -c
    - cmd.exe
    - .bat
    - .vbs
    - .ps1
  filter_legitimate_git:
    ParentImage|endswith:
    - \\cmd.exe
    - \\powershell.exe
    CommandLine|contains: clone
  condition: selection and not filter_legitimate_git
falsepositives:
- Development environments using Git for legitimate script execution
- Custom build automation tools invoking gcmd.exe with local scripts
level: high
id: 17cf7883-9991-5ed2-837b-b06b3d542973
status: experimental
author: Vorant

Process Fingerprinting via Volume Serial Number and Computer Name

ATT&CK T1140

Process executing commands to query volume serial number (vol command or WMI) and computer name in sequence, typical victim fingerprinting pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Process Fingerprinting via Volume Serial Number and Computer Name
description: Detects sequential or combined execution of system queries to retrieve
  volume serial number and computer name - indicators of malware fingerprinting for
  C2 beaconing or targeting decisions. Targets vol, wmic, or PowerShell commands querying
  these properties.
tags:
- attack.reconnaissance
- attack.t1140
logsource:
  category: process_creation
  product: windows
detection:
  selection_vol:
    CommandLine|contains: 'vol '
  selection_hostname:
    CommandLine|contains:
    - hostname
    - computername
  selection_wmic:
    CommandLine|contains: wmic logicaldisk get volumeserialnumber
  selection_powershell_serial:
    Image|endswith: \\powershell.exe
    CommandLine|contains:
    - Get-Volume
    - SerialNumber
  filter_admin_tools:
    ParentImage|endswith:
    - \\System32\\services.exe
    - \\svchost.exe
  condition: (selection_vol or selection_wmic or selection_powershell_serial) and
    (selection_hostname or selection_vol or selection_wmic) and not filter_admin_tools
falsepositives:
- System administration scripts collecting hardware inventory
- IT monitoring and asset management tools
level: medium
id: d12896ce-12f4-5d7b-99aa-88b74f908825
status: experimental
author: Vorant

COM Hijacking Registry Modification for Persistence

ATT&CK T1546.015

Registry write to HKLM/HKCU COM InprocServer32 or LocalServer32 keys with values pointing to unusual executables or DLLs dropped by recent process. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: COM Hijacking Registry Modification for Persistence
description: Detects suspicious registry modifications to COM InprocServer32 or LocalServer32
  paths, particularly when targeting CLSIDs or ProgIDs not associated with Windows
  defaults. Typical persistence mechanism for SpyGlace and similar loaders.
tags:
- attack.persistence
- attack.t1546.015
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
    - InprocServer32
    - LocalServer32
    Details|contains:
    - .dat
    - \\Temp\\
    - \\AppData\\Local\\
    - powershell
    - cmd.exe
  filter_windows_com:
    Details|contains:
    - System32
    - SysWOW64
    TargetObject|contains:
    - Microsoft.Windows
    - '{0002DF01-0000'
  condition: selection and not filter_windows_com
falsepositives:
- Custom application installers registering COM components in user AppData
- Software deployment tools modifying COM registry hives
level: high
id: 8a68e2c8-fdd5-5505-8b5b-0d8e44d31fda
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://blogs.jpcert.or.jp/en/2025/11/APT-C-60_update.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free