Update on Attacks by Threat Group APT-C-60 in 2026

APT-C-60 continues its campaign against Japanese organizations in 2026 by employing spear-phishing emails containing Proton Drive links or RAR archives with LNK files. These LNK files trigger JavaScript execution through mshta.exe, initiating a multi-stage infection chain. The attackers utilize legitimate developer platforms and CDNs (GitHub, GitLab, jsDelivr, Codeberg) to host obfuscated JavaScript payloads and scripts. They use git.exe to run scripts that download and load SpyGlace malware versions 3.1.15 to 3.1.18. The attack chain includes multiple obfuscated scripts and persistence techniques consistent with previous APT-C-60 campaigns. This approach allows the threat actor to evade detection by blending malicious activity with normal developer and network traffic.

Successful exploitation results in the deployment of SpyGlace malware, which can compromise targeted systems and enable persistent access. The use of legitimate services for hosting and execution complicates detection and response efforts. The multi-stage infection and living-off-the-land tactics increase the difficulty of identifying and mitigating the threat within corporate environments.

No official patch or fix is applicable as this is a threat actor campaign rather than a software vulnerability. Organizations should focus on user awareness training to recognize spear-phishing attempts, especially those involving Proton Drive links or suspicious RAR attachments. Monitoring for unusual use of mshta.exe, git.exe, and LNK file execution may help detect infection attempts. Restricting or monitoring access to developer platforms and CDNs used in the attack chain can reduce risk. Employ endpoint detection and response solutions capable of identifying living-off-the-land techniques and obfuscated script execution.