APT-C-60 Campaign: Malicious VHDX Hosted on Google Drive Lures Job Applicants

According to JPCERT/CC, the APT-C-60 campaign continues to target recruitment professionals in Japan, with attackers now attaching weaponised VHDX files directly to emails after evolving from Google Drive-hosted files observed earlier. The operation uses a multi-stage infection flow: recipients mount the VHDX, open an embedded LNK shortcut, and trigger gcmd.exe, a legitimate Git component, to process a glog.txt script inside the VHDX container, letting the attackers bypass many security controls.

The initial script creates a decoy resume, establishes persistence via COM hijacking targeting the CLSID {566296fe-e0e8-475f-ba9c-a31ad31620b1}, and runs Downloader1 which communicates with StatCounter to identify compromised devices, with configuration data uploaded to GitHub repositories under attacker control. SpyGlace has three updated versions—3.1.12, 3.1.13, and 3.1.14—showing enhanced anti-analysis and new capabilities such as a load-unload module function and a modified RC4-based encoding scheme.

GitHub and StatCounter traffic patterns are used alongside legitimate services to hinder detection, with version activity dated 27 June 2025, 3 July 2025, and 16 July 2025, highlighting rapid iteration by the threat actors.