Update on Attacks by Threat Group APT-C-60 in 2026 – JPCERT/CC Eyes

MITRE Techniques

• [T1566.002] Spearphishing Link – Victims were enticed through phishing emails containing a Proton Drive link to retrieve the malicious archive (‘the spear-phishing email contained a Proton Drive link’).
• [T1566.001] Spearphishing Attachment – A similar case used a malicious file attached directly to the email (‘the malicious file was attached directly to the email’).
• [T1204.002] Malicious File – LNK execution – The victim had to open an LNK file from the extracted archive to start the infection (‘Once the victim opens the LNK file, the subsequent infection process is executed’).
• [T1059.007] JavaScript – The LNK file launched embedded JavaScript to continue the attack (‘uses mshta.exe to execute JavaScript embedded within the LNK file’).
• [T1218.005] Mshta – The attackers used a signed Windows utility to execute the embedded script (‘uses mshta.exe to execute JavaScript’).
• [T1105] Ingress Tool Transfer – The script downloaded payload-related files from jsDelivr and other legitimate services (‘Downloads the file contributing[1].txt from jsDelivr’).
• [T1027] Obfuscated Files or Information – The embedded JavaScript was obfuscated to hinder analysis (‘Although the JavaScript code embedded in the LNK file is obfuscated’).
• [T1059.003] Windows Command Shell – Script execution through legitimate tooling and downloaded scripts was used to carry out the next stage (‘uses the legitimate git.exe … to execute a script in the same folder’).
• [T1106] Native API / Windows Command and Scripting Interpreter Execution – Legitimate Windows functionality was used to execute follow-on payloads (‘use a legitimate Windows program while carrying out processes’).
• [T1588.002] Tool – The threat actor leveraged legitimate developer services and CDN platforms as infrastructure (‘GitHub, GitLab, jsDelivr, and Codeberg… abused as attack infrastructure’).