Log in Request a demo

Threat group profile

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace.

In short

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Last updated 10 October 2026

Profile MapThreat Group
  1. Names1name in public reportsAPT-C-60
  2. Sectors1named as targetsRecruitment staff
  3. Techniques11in the attack chainInitial Access · Execution · Defense Evasion
  4. Tools4tools and malware listedSpyGlace · SecureBootUEFI.dat · WebClassUser.dat

In one minute

Who they are
JPCERT/CC says the group APT-C-60 is likely behind attacks it confirmed in Japan from August 2024. No government or MITRE source used here names a country or sponsor, and MITRE has no group page under this name.
Who they target
JPCERT/CC reports attacks on organizations in Japan, written to recruitment staff, and says the group mainly targets Japan and other East Asian regions.
How they usually get in
An email posing as a job seeker brings a disk image or archive with a shortcut file. In 2024 the file came by a Google Drive link, in 2025 as an attachment, and in 2026 by a Proton Drive link or attachment.
What stands out
It abuses legitimate services (Bitbucket, StatCounter, GitHub, GitLab, jsDelivr, Codeberg) to hand out files and track infected devices, and it makes malware persistent through COM hijacking.
What to do first
Tell recruitment and HR staff not to open cloud links, disk images, archives or shortcut files from unknown applicants.

Names

Public reports use several names for this activity.

Names used for APT-C-60
NameWhere it appears
APT-C-60 JPCERT/CC blog reports of 11 December 2024, 5 November 2025 and 13 July 2026[1, 2, 3]

Who says so

Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.

  • JPCERT/CC 11 December 2024

    Confirmed an attack on an organization in Japan in August 2024 that the group APT-C-60 "is likely to have conducted". It names no country or sponsor.[1]

  • JPCERT/CC 5 November 2025

    Said it continued to see similar attacks in Japan between June and August 2025, and that APT-C-60 continues to target mainly Japan and other East Asian regions. It names no country or sponsor.[2]

  • JPCERT/CC 13 July 2026

    Reported more APT-C-60 activity against organizations in Japan in 2026, with changes to the first step and to the services used as infrastructure. It names no country or sponsor.[3]

  • MITRE ATT&CK 10 October 2026

    The groups list checked for this page has no entry named APT-C-60.[4]

Who they target

Sectors

  • Recruitment staffThe emails went to the recruitment contact point of the target, written as if from a job seeker.[1, 2]

Regions

  • JapanJPCERT/CC confirmed attacks on organizations in Japan in August 2024, between June and August 2025, and in 2026.[1, 2, 3]
  • East AsiaJPCERT/CC says the attacks mainly target Japan and other East Asian regions. Decoy files in a 2024 sample suggest similar attacks may also have reached South Korea and China.[1, 2]

Operations timeline

Each entry is attributed to the group by the sources cited.

  1. August 2024

    Attack on an organization in Japan

    JPCERT/CC says an email posing as a job applicant went to the recruitment contact point. It led to a virtual disk file (VHDX) with a shortcut file, hosted on Google Drive.[1]

  2. 11 December 2024

    JPCERT/CC report

    JPCERT/CC publishes its first report on APT-C-60 and the SpyGlace backdoor (version 3.1.6 in the sample it checked).[1]

  3. June to August 2025

    Similar attacks continue

    JPCERT/CC says the disk file was now attached directly to the email, and that SpyGlace versions 3.1.12, 3.1.13 and 3.1.14 were seen, with payloads held on GitHub.[2]

  4. 5 November 2025

    JPCERT/CC update

    JPCERT/CC reports the 2025 changes: GitHub in place of Bitbucket, and a new SpyGlace command.[2]

  5. 2026

    New first step and services

    JPCERT/CC says a Proton Drive link led to a RAR archive holding a shortcut file that ran JavaScript through mshta.exe. GitLab, jsDelivr and Codeberg were used as well as GitHub. SpyGlace versions 3.1.15, 3.1.17 and 3.1.18 were seen.[3]

  6. 13 July 2026

    JPCERT/CC report

    JPCERT/CC publishes its 2026 update.[3]

How they get in

Techniques reported for this group, by MITRE ATT&CK tactic.

Initial Access

  • Phishing: Spearphishing Attachment T1566.001

    JPCERT/CC says the 2025 emails carried the malicious VHDX file as an attachment, and some 2026 emails carried the file directly.[2, 3, 5]

  • Phishing: Spearphishing Link T1566.002

    JPCERT/CC says the 2024 email held a Google Drive link and a 2026 email held a Proton Drive link.[1, 3, 6]

Execution

  • User Execution: Malicious File T1204.002

    The infection starts when the recipient opens the shortcut (LNK) file inside the disk image or archive.[1, 2, 3, 7]

  • Command and Scripting Interpreter: JavaScript T1059.007

    In 2026 the shortcut file held obfuscated JavaScript that fetched the next stage.[3, 14]

Persistence

  • Event Triggered Execution: Component Object Model Hijacking T1546.015

    The downloaders and later files were made to run again by registering them under COM interface IDs.[1, 2, 8]

Defense Evasion

  • System Binary Proxy Execution: Mshta T1218.005

    In 2026 the shortcut file used mshta.exe to run its JavaScript.[3, 10]

  • Deobfuscate/Decode Files or Information T1140

    Downloaded files are decoded with Base64 and XOR keys before they run.[1, 2, 13]

Collection

  • Screen Capture T1113

    SpyGlace has commands to upload a screenshot or send screenshots automatically.[1, 12]

Command and Control

  • Web Service T1102

    Bitbucket, StatCounter, GitHub, GitLab, jsDelivr and Codeberg were used to track infected devices and hand out files.[1, 2, 3, 9]

  • Application Layer Protocol: Web Protocols T1071.001

    SpyGlace talks to its servers with HTTP requests.[1, 15]

  • Ingress Tool Transfer T1105

    Downloaders fetch further files, including SpyGlace and its loader, from the services above.[1, 2, 3, 11]

Tools and malware

  • SpyGlace Backdoor

    JPCERT/CC says it is the backdoor used. Commands include remote shell, file upload and download, process listing and control, disk information and screenshots.[1, 2, 3]

  • SecureBootUEFI.dat Downloader

    The 2024 downloader. It contacts StatCounter and Bitbucket and is made persistent by COM hijacking.[1]

  • WebClassUser.dat Downloader

    The 2025 first downloader. It contacts StatCounter and GitHub and is made persistent by COM hijacking.[2]

  • Git (git.exe, gcmd.exe) Legitimate program misused

    A genuine Git file is used to run the script that starts the infection.[1, 2, 3]

Detection and defense

  1. Do not open cloud links from unknown senders

    JPCERT/CC advises users to be careful with cloud storage links in suspicious emails. Applies to emails sent to recruitment staff.

    Counters T1566.002

  2. Do not open shortcut files inside archives

    JPCERT/CC advises against opening LNK files inside archives such as RAR files.

    Counters T1204.002 T1566.001

  3. Do not rely on blocking by destination

    JPCERT/CC notes that developer services and CDNs are often allowed in company networks, so blocking by address alone is hard. Look at what runs and why.

    Counters T1102 T1105

What Brandefense can do

Questions

What is APT-C-60?

It is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024. The attacks used a backdoor called SpyGlace.

Which country is behind APT-C-60?

The sources used for this page do not say. JPCERT/CC names no country or sponsor, and MITRE ATT&CK has no group page under this name in the list checked on 10 October 2026.

How do the attacks start?

By email written as if from a job seeker and sent to recruitment staff. The email links to or carries a disk image or archive holding a shortcut file. Opening the shortcut starts the infection.

Which services does the group abuse?

JPCERT/CC lists Bitbucket, StatCounter, GitHub, GitLab, jsDelivr and Codeberg. Blocking by address alone is hard because companies often allow these services.

What should a company do first?

Teach recruitment and HR staff not to open cloud links, disk images, archives or shortcut files from unknown applicants, as JPCERT/CC advises.

Sources

  1. Attack Exploiting Legitimate Service by APT-C-60 JPCERT/CC Supports: August 2024 attack, job-applicant email, downloader, SpyGlace commands, East Asia
  2. Update on Attacks by Threat Group APT-C-60 JPCERT/CC Supports: June to August 2025 attacks, direct attachment, GitHub, SpyGlace versions
  3. Update on Attacks by Threat Group APT-C-60 in 2026 JPCERT/CC Supports: 2026 attacks, Proton Drive, mshta.exe, new services, advice to users
  4. Groups list MITRE ATT&CK Supports: No entry named APT-C-60 at the check on 10 October 2026
  5. Phishing: Spearphishing Attachment, T1566.001 MITRE ATT&CK Supports: Technique id and name
  6. Phishing: Spearphishing Link, T1566.002 MITRE ATT&CK Supports: Technique id and name
  7. User Execution: Malicious File, T1204.002 MITRE ATT&CK Supports: Technique id and name
  8. Event Triggered Execution: Component Object Model Hijacking, T1546.015 MITRE ATT&CK Supports: Technique id and name
  9. Web Service, T1102 MITRE ATT&CK Supports: Technique id and name
  10. System Binary Proxy Execution: Mshta, T1218.005 MITRE ATT&CK Supports: Technique id and name
  11. Ingress Tool Transfer, T1105 MITRE ATT&CK Supports: Technique id and name
  12. Screen Capture, T1113 MITRE ATT&CK Supports: Technique id and name
  13. Deobfuscate/Decode Files or Information, T1140 MITRE ATT&CK Supports: Technique id and name
  14. Command and Scripting Interpreter: JavaScript, T1059.007 MITRE ATT&CK Supports: Technique id and name
  15. Application Layer Protocol: Web Protocols, T1071.001 MITRE ATT&CK Supports: Technique id and name

Other groups

All groups

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Attributed by the US, UK and South Korean governments, and MITRE ATT&CK

  • KPAttributed to North Korea
Active since 2009 Full profile

APT1

Also known as Comment Crew · Comment Panda · Comment Group

Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. The Department of Justice alleges the aim was commercial gain for China's state-owned firms.

Attributed by the US Department of Justice (indictment of 19 May 2014) and MITRE ATT&CK

  • CNAttributed to China
Active since 2006 Full profile

APT18

APT18 (MITRE G0026) is described by MITRE ATT&CK as a threat group active since at least 2009, with targets in technology, manufacturing, government and medical sectors. A US health sector briefing (HHS HC3, 2020) lists suspected attribution to China; no advisory, indictment or named sponsor was found.

Active since 2009 Full profile

Keep exploring

Knowledge Hub

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more

Glossary term

Initial access

Initial access is the first step in which an attacker gets into a target network.

Read more

Technique

Phishing (T1566): ATT&CK Technique

Phishing is when an attacker sends a message that tricks someone into opening a malicious file, following a link or giving away a password.

Read more

Technique

User Execution

User Execution is when an attacker gets a person to run malicious code for them.

Read more