VORANT. Threat Intelligence Sign in Get the full feed

APT-C-60 abuses cloud services to deploy SpyGlace

high threat

APT-C-60 is using Proton Drive, LNK files, and abused GitHub/GitLab/jsDelivr/Codeberg infrastructure to deliver the SpyGlace backdoor against Japanese organizations.

JPCERT/CC reports continued 2026 activity from APT-C-60, a threat group previously documented targeting Japanese organizations in 2024 and 2025. The current campaign begins with spear-phishing emails containing either a Proton Drive link or a direct attachment leading to a RAR archive with a malicious LNK file. Execution of the LNK triggers mshta.exe to run embedded obfuscated JavaScript, which retrieves a file from jsDelivr, extracts a legitimate git.exe binary, and uses it to run a script that assembles a downloader from .db files, ultimately fetching and executing the SpyGlace malware (observed versions v3.1.15–v3.1.18).

A notable shift from prior campaigns is the expansion of abused legitimate infrastructure: while 2025 activity relied on GitHub and Bitbucket, the 2026 wave adds GitLab, jsDelivr, and Codeberg as staging and C2-adjacent hosting, likely to blend malicious traffic with normal developer/CDN activity that is commonly allowlisted in enterprise environments. JPCERT/CC published C2 IPs, attacker-controlled repositories, phishing sender addresses, and commit email addresses, along with evidence of multiple victim devices identified via repository metadata, indicating an active and ongoing intrusion set rather than an isolated incident.

Mentioned in this report

Threat actors APT-C-60
Malware SpyGlace

Detection guidance

Legitimate git.exe Dropped and Executed by Script Interpreter Parent

ATT&CK T1105

Detects git.exe being spawned by script host processes (mshta, wscript, cscript, cmd, powershell) outside typical developer contexts, matching the APT-C-60 pattern of extracting and abusing a legitimate git binary to assemble a downloader from staged .db files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Legitimate git.exe Dropped and Executed by Script Interpreter Parent
id: 18c6d2c2-b624-53fb-895b-1bb86466dafa
status: experimental
description: Detects git.exe launched by mshta, wscript, cscript, cmd, or powershell,
  a pattern consistent with abuse of a legitimate git binary extracted and run by
  script-based downloaders (e.g. APT-C-60 SpyGlace delivery chain) rather than by
  developer tools/IDEs.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \\git.exe
    ParentImage|endswith:
    - \\mshta.exe
    - \\wscript.exe
    - \\cscript.exe
    - \\cmd.exe
    - \\powershell.exe
  filter_devtools:
    ParentImage|endswith:
    - \\Code.exe
    - \\GitHubDesktop.exe
    - \\sourcetree.exe
    - \\devenv.exe
  condition: selection and not filter_devtools
falsepositives:
- Legitimate CI/CD or build scripts invoking git.exe from cmd or powershell parents
- Developer automation tooling that wraps git operations in scripting hosts
level: high
tags:
- attack.t1105
- attack.t1027
- attack.t1204.002
author: Vorant

Script Host Process Connecting to Developer CDN or Git Hosting Services

ATT&CK T1102

Detects mshta, wscript, or cscript processes making outbound connections to code-hosting/CDN services (jsDelivr, GitHub, GitLab, Codeberg) abused as staging and C2-adjacent infrastructure in the APT-C-60 SpyGlace delivery chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Script Host Process Connecting to Developer CDN or Git Hosting Services
id: 5226e16f-e994-504d-905f-5904c73125a8
status: experimental
description: Detects mshta.exe, wscript.exe, or cscript.exe establishing outbound
  network connections to jsDelivr, GitHub, GitLab, or Codeberg domains, consistent
  with abuse of legitimate developer/CDN infrastructure for staging and downloading
  second-stage payloads as observed in APT-C-60 SpyGlace campaigns.
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \\mshta.exe
    - \\wscript.exe
    - \\cscript.exe
    DestinationHostname|contains:
    - jsdelivr.net
    - githubusercontent.com
    - github.com
    - gitlab.com
    - codeberg.org
  condition: selection
falsepositives:
- Developer workstations using scripting hosts for legitimate automation against these
  code-hosting/CDN services
- Internal tooling that fetches configuration or assets from jsDelivr CDN via scripted
  clients
level: medium
tags:
- attack.t1102
- attack.t1105
- attack.t1218.005
author: Vorant

2 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://blogs.jpcert.or.jp/en/2026/07/apt-c-60_2026.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free