MalwarePublished 5 Nov 2025Updated 5 Dec 2025

Update on Attacks by Threat Group APT-C-60

Source AlienVault OTX General

Description

APT-C-60 continues to target Japan and East Asia with spear-phishing attacks impersonating job seekers. The attack flow has evolved, now directly attaching malicious VHDX files to emails. The malware, including Downloader1, Downloader2, and SpyGlace, has been updated with new features and communication methods. SpyGlace versions 3.1.12, 3.1.13, and 3.1.14 were observed, with changes in Mutex values and execution paths. The attackers use GitHub for payload distribution and employ sophisticated encoding and encryption techniques. The campaign abuses legitimate services and maintains consistent behavioral patterns despite infrastructure changes.

Impact

For European organizations, the primary impact of this threat lies in potential espionage, data exfiltration, and network compromise, especially for entities with business or strategic interests in East Asia or Japan. The use of spear-phishing with convincing social engineering tactics increases the risk of initial compromise. The malware's ability to maintain persistence and evade detection through legitimate service abuse and encryption techniques could lead to prolonged undetected access. Organizations involved in recruitment, international trade, or technology sectors may be particularly targeted or indirectly affected. The use of VHDX attachments could bypass some traditional email defenses, increasing the risk of infection. While no widespread exploitation in Europe has been reported, the global nature of GitHub-hosted payloads and the use of common Windows features mean that European networks are potentially vulnerable if targeted. The compromise of confidentiality, integrity, and availability of systems could result in intellectual property theft, disruption of operations, and reputational damage.

Defensive guidance

European organizations should implement advanced email filtering solutions capable of detecting and blocking malicious VHDX attachments and spear-phishing attempts impersonating job seekers. Deploy sandboxing technologies to analyze suspicious attachments in a controlled environment before delivery. Monitor network traffic for unusual communications, especially encrypted or encoded data flows consistent with SpyGlace and downloader malware behavior. Employ endpoint detection and response (EDR) tools to identify persistence mechanisms such as COM hijacking and execution via trusted binaries. Regularly update and patch systems to reduce the attack surface, even though no specific patches are linked to this threat. Conduct targeted user awareness training focusing on spear-phishing risks related to recruitment and job-seeking themes. Restrict or monitor the use of legitimate services like GitHub for payload hosting by implementing allowlists or anomaly detection. Implement strict application control policies to prevent execution of unauthorized VHDX files and related payloads. Finally, establish incident response plans that include procedures for detecting and mitigating advanced persistent threats with similar tactics.

Indicators of compromise

IP addresses 1

185.181.230.71

Hashes 39

1171f3fc801556a6e19f65cff4eb1314
1f5fd1ba93a55bebbb7c06bfeec4ad5e
21a44712685a8ba42985783b67883999
8fb1ae1bc6e8fa3a6d7cc335ac4d379b
90b149c69b149c4b99c04d1dc9b940b9
b0747c82c23359d1342b47a669796989
738554c1a41dfdbb2b23b35a38686d1e41e24f3f
9f30bfc05bc79c85997731038a1647c5cf04b7d3
b838caa938ef0b7bf54a2b8e5109cc31e402de63
048b69386410b8b7ddb7835721de0cba5945ee026a9134d425e0ba0662d9aee4

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 5 Nov 2025, 08:56 UTC

MITRE ATT&CK techniques12 from threat tags

Technical details

Indicators of compromise

IP addresses 1

Hashes 39

Community reviews

Related threats