APT-C-60 Targets Japan: New SpyGlace Malware Uses VHDX LNK and GitHub Tasking for Persistent Espionage

According to JPCERT/CC, the Incident Response Group published a detailed report on a renewed wave of APT-C-60 cyber-espionage targeting Japanese organisations between June and August 2025, introducing new downloader variants and an evolved SpyGlace malware. Attackers continue to rely on spear-phishing emails aimed at HR or recruitment departments, with messages impersonating job seekers and containing a malicious VHDX disk image.

Once opened, the VHDX delivers a Windows shortcut (LNK) that triggers Git’s legitimate gcmd.exe to run an obfuscated script called glog.txt, a multi-layered approach designed to evade traditional endpoint detection. The campaign uses a refined downloader stage (Downloader1 and Downloader2) to enhance victim tracking and persistence, including constructing a unique URL pattern on GitHub to fetch additional payloads.

SpyGlace has evolved through versions 3.1.12, 3.1.13 and 3.1.14, adding new commands and changing persistence paths, with encryption and C2 traffic increasingly sophisticated and tailored to the region.