APT-C-60 abuses cloud services to deploy SpyGlace
APT-C-60 is using Proton Drive, LNK files, and abused GitHub/GitLab/jsDelivr/Codeberg infrastructure to deliver the SpyGlace backdoor against Japanese organizations.
Sourceblogs.jpcert.or.jp — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
JPCERT/CC reports continued 2026 activity from APT-C-60, a threat group previously documented targeting Japanese organizations in 2024 and 2025. The current campaign begins with spear-phishing emails containing either a Proton Drive link or a direct attachment leading to a RAR archive with a malicious LNK file. Execution of the LNK triggers mshta.exe to run embedded obfuscated JavaScript, which retrieves a file from jsDelivr, extracts a legitimate git.exe binary, and uses it to run a script that assembles a downloader from .db files, ultimately fetching and executing the SpyGlace malware (observed versions v3.1.15–v3.1.18).
A notable shift from prior campaigns is the expansion of abused legitimate infrastructure: while 2025 activity relied on GitHub and Bitbucket, the 2026 wave adds GitLab, jsDelivr, and Codeberg as staging and C2-adjacent hosting, likely to blend malicious traffic with normal developer/CDN activity that is commonly allowlisted in enterprise environments. JPCERT/CC published C2 IPs, attacker-controlled repositories, phishing sender addresses, and commit email addresses, along with evidence of multiple victim devices identified via repository metadata, indicating an active and ongoing intrusion set rather than an isolated incident.
Mentioned in this report
Detection guidance
Legitimate git.exe Dropped and Executed by Script Interpreter Parent
A behavioural hunt for the technique in general.
Detects git.exe being spawned by script host processes (mshta, wscript, cscript, cmd, powershell) outside typical developer contexts, matching the APT-C-60 pattern of extracting and abusing a legitimate git binary to assemble a downloader from staged .db files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Legitimate git.exe Dropped and Executed by Script Interpreter Parent
id: 18c6d2c2-b624-53fb-895b-1bb86466dafa
status: experimental
description: Detects git.exe launched by mshta, wscript, cscript, cmd, or powershell,
a pattern consistent with abuse of a legitimate git binary extracted and run by
script-based downloaders (e.g. APT-C-60 SpyGlace delivery chain) rather than by
developer tools/IDEs.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \\git.exe
ParentImage|endswith:
- \\mshta.exe
- \\wscript.exe
- \\cscript.exe
- \\cmd.exe
- \\powershell.exe
filter_devtools:
ParentImage|endswith:
- \\Code.exe
- \\GitHubDesktop.exe
- \\sourcetree.exe
- \\devenv.exe
condition: selection and not filter_devtools
falsepositives:
- Legitimate CI/CD or build scripts invoking git.exe from cmd or powershell parents
- Developer automation tooling that wraps git operations in scripting hosts
level: high
tags:
- attack.t1105
- attack.t1027
- attack.t1204.002
author: Vorant
Script Host Process Connecting to Developer CDN or Git Hosting Services
A behavioural hunt for the technique in general.
Detects mshta, wscript, or cscript processes making outbound connections to code-hosting/CDN services (jsDelivr, GitHub, GitLab, Codeberg) abused as staging and C2-adjacent infrastructure in the APT-C-60 SpyGlace delivery chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Script Host Process Connecting to Developer CDN or Git Hosting Services
id: 5226e16f-e994-504d-905f-5904c73125a8
status: experimental
description: Detects mshta.exe, wscript.exe, or cscript.exe establishing outbound
network connections to jsDelivr, GitHub, GitLab, or Codeberg domains, consistent
with abuse of legitimate developer/CDN infrastructure for staging and downloading
second-stage payloads as observed in APT-C-60 SpyGlace campaigns.
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith:
- \\mshta.exe
- \\wscript.exe
- \\cscript.exe
DestinationHostname|contains:
- jsdelivr.net
- githubusercontent.com
- github.com
- gitlab.com
- codeberg.org
condition: selection
falsepositives:
- Developer workstations using scripting hosts for legitimate automation against these
code-hosting/CDN services
- Internal tooling that fetches configuration or assets from jsDelivr CDN via scripted
clients
level: medium
tags:
- attack.t1102
- attack.t1105
- attack.t1218.005
author: Vorant
2 more detections for this report are in the app — indicator rules, each with Sigma, Splunk SPL, Elastic, and Suricata. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://blogs.jpcert.or.jp/en/2026/07/apt-c-60_2026.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs