North Korean-linked threat group APT-C-60 has updated its cyberespionage playbook, weaponizing Proton Drive, GitHub, GitLab, Codeberg, and jsDelivr to deploy SpyGlace malware against Japanese organizations. Here is what developers and security teams need to know.

The Campaign at a Glance

JPCERT/CC has documented APT-C-60's latest activity, which represents a significant evolution in how state-sponsored espionage groups abuse trusted developer infrastructure. The group is now using a multi-stage infection chain that combines:

• Spear-phishing emails with Proton Drive links or direct RAR attachments
• Malicious Windows shortcut (LNK) files as initial execution vectors
• Living-off-the-land techniques using mshta.exe and git.exe
• CDN-hosted payloads on jsDelivr for the final-stage SpyGlace malware
• GitHub, GitLab, and Codeberg repositories for staging and distribution

The Infection Chain

Stage 1: Initial Access

The campaign begins with a spear-phishing email that either contains a Proton Drive link or has a password-protected RAR archive directly attached. The archive contains a malicious Windows LNK file that masquerades as a legitimate document.

Stage 2: Execution via Living Off the Land

When the victim opens the LNK file, it copies itself and invokes mshta.exe (a legitimate Microsoft HTML Application host) to execute embedded JavaScript. This living-off-the-land binary approach makes detection harder because mshta.exe is a trusted Windows component.

Stage 3: Payload Staging on CDN

The obfuscated JavaScript downloads a file named contributing[1].txt from the jsDelivr content delivery network. The file is encoded and requires search, decode, and extraction steps that the script performs automatically.

Stage 4: Weaponized Git Binary

After extracting the downloaded content, the infection uses a legitimate git.exe binary to execute the next-stage script. Using git.exe from temporary or user-writable directories is a red flag that many endpoint detection systems miss.

Stage 5: SpyGlace Malware Deployment

The final payload, SpyGlace, establishes command-and-control communication with attacker infrastructure for data exfiltration and ongoing espionage operations.

Why Developer Platforms Are the Perfect Cover

APT-C-60's campaign succeeds because trusted developer services are rarely blocked by corporate firewalls. A connection to GitHub, GitLab, or jsDelivr is not automatically suspicious. The group specifically:

• Hosts malicious components on GitHub, GitLab, and Codeberg where they blend in with legitimate repositories
• Uses jsDelivr (a popular open-source CDN) to serve the next-stage payload, making network traffic look like normal CDN usage
• Leverages Proton Drive to bypass email gateway controls since the malicious archive is hosted externally

This creates a fundamental detection challenge: security teams can't simply block these platforms without breaking developer workflows.

SpyGlace Command-and-Control Infrastructure

IoC Type	Indicator	Description
C2 IP	31.58.136[.]207	SpyGlace command-and-control server
C2 IP	154.18.239[.]209	SpyGlace command-and-control server
C2 IP	173.234.11[.]141	SpyGlace command-and-control server

How to Detect APT-C-60 Activity

JPCERT/CC recommends hunting for these indicators:

1. Suspicious mshta.exe execution originating from LNK files rather than from its expected system location
2. Unexpected git.exe usage running from temporary or user-writable directories
3. Downloads from developer platforms immediately followed by script execution
4. Connection to SpyGlace C2 infrastructure from systems in your organization

Mitigation Steps for Development Teams

1. Audit developer platform usage , monitor what repositories team members access and what files they download
2. Restrict mshta.exe execution , use AppLocker or WDAC to block mshta.exe from launching from user-writable paths
3. Monitor git.exe behavior , alert when git.exe runs from non-standard directories
4. Treat cloud-storage links with password-protected archives as high-risk
5. Block C2 infrastructure , add SpyGlace IPs to your firewall and SIEM

Frequently Asked Questions

What is APT-C-60? APT-C-60 is a North Korean-linked advanced persistent threat group known for cyberespionage operations primarily targeting Japanese organizations.

What is SpyGlace malware? SpyGlace is a remote access trojan used by APT-C-60 for data exfiltration and espionage after initial compromise.

Why is this relevant to developers? The attack abuses GitHub, GitLab, Codeberg, jsDelivr, and Proton Drive , platforms developers use daily. Understanding the threat helps teams watch for suspicious activity on trusted services.

How can I detect if my system is compromised? Look for mshta.exe running from unusual locations, git.exe executed from temp directories, and network connections to the SpyGlace C2 IPs listed above.

Does standard antivirus block SpyGlace? Not reliably. The attack uses living-off-the-land techniques with legitimate Windows binaries that bypass signature-based detection.

Key Takeaways

• APT-C-60 uses Proton Drive and developer platforms (GitHub, GitLab, Codeberg, jsDelivr) to deploy SpyGlace malware
• The attack targets Japanese organizations but the methodology applies globally
• Living-off-the-land techniques with mshta.exe and git.exe make signature-based detection difficult
• Behavior-based detection and monitoring of developer platform usage are the most effective defenses
• Block SpyGlace C2 infrastructure (31.58.136[.]207, 154.18.239[.]209, 173.234.11[.]141)

The abuse of developer platforms for malware delivery is a growing trend. APT-C-60's latest campaign shows that even trusted CDNs and code repositories can be weaponized. Development teams must treat unexpected downloads from these platforms with the same scrutiny as any other untrusted source.

---

Source: JPCERT/CC incident report, July 2026