JPCERT/CC observed APT-C-60 spear-phishing attacks in Japan (June–August 2025) that use attached VHDX files containing LNKs which execute legitimate git (gcmd.exe) to run malicious scripts, leading to persistence via COM hijacking and deployment of Downloaders and SpyGlace. The campaign uses GitHub/statcounter for C2 and payload distribution, employs custom encoding (XOR+ADD, modified RC4, AES-128-CBC with known KEY/IV), and includes decoy resumes targeting recruitment staff. #APT-C-60 #SpyGlace #statcounter
Keypoints
- Attacks used targeted spear-phishing to recruitment staff with malicious VHDX attachments containing LNKs that launch gcmd.exe to execute embedded scripts.
- Malicious script creates WebClassUser.dat (Downloader1), registers a COM CLSID for persistence, and performs COM hijacking to execute payloads.
- Downloader1 uses statcounter referrer values including VolumeSerialNumber+ComputerName to identify infected hosts and retrieves per-host command files from GitHub repositories.
- Downloader2 fetches and XOR-decodes additional components (including SpyGlace), using evolving encoding schemes (ADD+XOR then XOR key strings) and COM hijacking for execution.
- SpyGlace observed in versions 3.1.12–3.1.14 with changes: disabled prockill/proclist, new uld command, altered screenupload module path/exports, changed mutex and autostart paths in 3.1.14.
- SpyGlace communication/encoding: BASE64 + modified RC4 with increased KSA cycles and added operations; one command uses AES-128-CBC with KEY B0747C82C23359D1342B47A669796989 and IV 21A44712685A8BA42985783B67883999.
- Attackers leverage GitHub (raw.githubusercontent.com) to host payloads and have commit metadata and per-host identifiers (volume serial numbers + computer names) exposed in repositories.
MITRE Techniques
- [T1193] Spearphishing Attachment – Attackers sent targeted emails with malicious VHDX attachments impersonating job seekers to recruitment staff (“targeted spear-phishing emails sent to recruitment staff, in which the attackers impersonated job seekers”).
- [T1218] Signed Binary Proxy Execution (Living-off-the-Land) – Use of legitimate git executable gcmd.exe to run attacker-controlled scripts (“The LNK file executes gcmd.exe (a legitimate Git file), and it runs the script glog.txt stored in the VHDX file”).
- [T1105] Ingress Tool Transfer – Downloading components from GitHub and other hosts (Downloader1/Downloader2 retrieve payloads from raw.githubusercontent.com and other URLs listed in Appendices).
- [T1543.001] Create or Modify System Process: Services – Persistence via COM hijacking and registry CLSID modification (“WebClassUser.dat … is registered in the registry … and then it gets persisted and executed through COM hijacking. HKCUSoftwareClassesCLSID{566296fe-e0e8-475f-ba9c-a31ad31620b1}InProcServer32”).
- [T1071.001] Web Protocols – Use of HTTP(S) for C2 and payload distribution including statcounter and raw.githubusercontent.com (“Downloader1 periodically communicates with a legitimate statistics service called statcounter… https://raw.githubusercontent.com/…[VolumeSerialNumber + ComputerName].txt”).
- [T1041] Exfiltration Over C2 Channel / [T1095] Non-Standard Port – Encoded C2 communications using BASE64 and modified RC4 (SpyGlace communicates with its C2 servers using BASE64 and RC4; headers include a001..a004 and CustomRC4 payloads).
- [T1113] Screen Capture – screenupload and screenauto commands to capture and upload screenshots, referencing a Clouds.db module and export mssc1 (“%LocalAppData%MicrosoftWindowsCloudsClouds.db … Export Function: mssc1”).
- [T1566.001] Phishing: Spearphishing Attachment – Decoy document (fabricated resume) used to socially engineer targets into opening attachments (“fabricated resume disguise the writer as a researcher and list multiple academic papers … name on the resume partially matches the Gmail account name used by the sender”).
- [T1059.001] Command and Scripting Interpreter: PowerShell / [T1059] Command Interpreter – Execution of scripts via command line piped into gcmd.exe and use of scripts (example command shown executing glog.txt via gcmd.exe “cd .LICENSES.LOGmingw64bin && type glog.txt | gcmd.exe”).
Indicators of Compromise
- [Domain/URL] C2 and distribution – statcounter referrer URL (https://c.statcounter.com/13139439/0/1ba1a548/1/), raw GitHub repo paths (https://raw.githubusercontent.com/carolab989/class2025/refs/heads/main/, https://raw.githubusercontent.com/football2025/class2025/refs/heads/main/).
- [IP Address] Malicious hosting – 185.181.230.71 hosting ASP payloads – examples: https[:]//185.181.230[.]71/wkdo9/4b3ru.asp, and other .asp endpoints.
- [File Hashes] Malicious VHDX and LNK – CV & Professional Experience.vhdx SHA256 f42d0fa77e5101f0f793e055cb963b45b36536b1835b9ea8864b4283b21bb68f; Resume.rtf.lnk SHA256 25f81709d914a0981716e1afba6b8b5b3163602037d466a02bc1ec97cdc2063b (and multiple other hashes listed in Appendix B, e.g., WebClassUser.dat f102d490…, WebCacheR.tmp.dat 57a77d8d…).
- [File Paths] Persistent and temporary files – %userprofile%AppDataLocalMicrosoftWindowsWebClassUser.dat (Downloader1), %temp%wcts66889.tmp (downloaded decrypted file), %localappdata%MicrosoftWindowsWebCacheWebCacheR.tmp.dat.
- [Mutex/CLASSID] Persistence and internal identifiers – Mutex examples K31610KIO9834PG79A90B and CLASSID {566296fe-e0e8-475f-ba9c-a31ad31620b1} used for COM hijack registration.
Read more: https://blogs.jpcert.or.jp/en/2025/11/APT-C-60_update.html