Loading malware…
SpyGlace is a custom Windows backdoor used by APT-C-60 for cyberespionage against targets in East Asia, including organizations in Japan and users in China. Its capabilities include remote command execution, file theft, downloading additional components, and loading and unloading modules. It collects host information, including computer and user names, processor information, and operating-system details, for command-and-control communications.
SpyGlace has been deployed through multiple infection chains. APT-C-60 exploited CVE-2024-7262 in WPS Office for Windows using a malicious MHTML spreadsheet with a concealed hyperlink that triggered code execution when clicked. Other campaigns used spear-phishing emails impersonating job applicants to target recruitment personnel. These attacks delivered malicious VHDX disk images or RAR archives, either as attachments or through cloud-storage links. Embedded Windows shortcuts initiated multistage execution using legitimate Git components and, in later campaigns, the Windows HTML Application host. Downloaders and loaders subsequently installed SpyGlace, with COM hijacking providing persistence within the infection chain.
The malware uses XOR and subtraction-based string obfuscation and dynamic API resolution. Its command-and-control protocol combines Base64 encoding with a modified RC4 cipher, while its download functionality uses AES-128-CBC to decrypt retrieved files. Associated campaigns abuse legitimate cloud-storage, developer-hosting, analytics, and CDN services to stage payloads, track compromised hosts, and distribute victim-specific tasking. Versions observed during 2025 and 2026 retained the core backdoor functionality while introducing incremental command, module-handling, and startup-location changes.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Larva-25001 deployed SpyGlace through Proton Drive, malicious RAR and LNK files, and a chain involving mshta.Exe and git.Exe.
ダウンローダーはこれらの正規サービスから最終的にSpyGlaceというマルウェアをダウンロードし、実行します。今回の攻撃ではSpyGlaceのv3.1.15、v3.1.17、v3.1.18を確認しています
26 distinct techniques documented for this family, organized by ATT&CK tactic.
APT-C-60 routed those later downloads through GitHub, GitLab, jsDelivr, and Codeberg. These sites serve developers and content every day, so their traffic can appear harmless in corporate networks.
また、類似の事例として、Proton Driveを経由せず、悪性ファイルがメールに直接添付されるパターンも確認しています。
今回確認した事例では、スピアフィッシングメールにProton Driveのリンクが記載され、Proton DriveからRARファイルをダウンロードさせる手法が使われていました。
展開されたフォルダー内にある正規のgit.exeを使用して同一フォルダー内のスクリプトを実行
When executed, the LNK file used during the infection copies itself and then uses mshta.exe to execute JavaScript embedded within the LNK file.
感染時に使用されたLNKファイルは、実行されると自身をコピーした後、mshta.exeを使用して自身に含まれているJavaScriptを実行します。
ESET researchers discovered a remote code execution vulnerability in WPS Office for Windows (CVE-2024-7262). APT-C-60, a South Korea-aligned cyberespionage group, was exploiting it to target East Asian countries.
Since this is a one-click vulnerability, the exploit developers embedded a picture of the spreadsheet’s rows and columns inside to deceive and convince the user that the document is a regular spreadsheet. The malicious hyperlink was linked to the image so that clicking on a cell in the picture would trigger the exploit.
deployed SpyGlace through Proton Drive, malicious RAR and LNK files
it contains a specially crafted and hidden hyperlink designed to trigger the execution of an arbitrary library if clicked... an attacker would need to store a malicious library somewhere accessible by the targeted computer either on the system or on a remote share, and know its file path in advance.
When executed, the LNK file used during the infection copies itself and then uses mshta.exe to execute JavaScript embedded within the LNK file.
When executed, the LNK file used during the infection copies itself and then uses mshta.exe to execute JavaScript embedded within the LNK file.
LNKファイルに含まれているJavaScriptコードは難読化されています
攻撃者は正規サービスを使用することで通信やダウンロードを一見正常なアクセスに見せかけようとしている可能性があります。
That code downloads a file named contributing1.txt, decodes it, and extracts its contents.
これによって、Windowsの正規プログラムを利用しながら後続のペイロード取得や実行につながる処理が行われます。
感染時に使用されたLNKファイルは、実行されると自身をコピーした後、mshta.exeを使用して自身に含まれているJavaScriptを実行します。
展開されたフォルダー内にある.dbファイルを結合することで、ダウンローダーを作成し、実行します。
it contains a specially crafted and hidden hyperlink designed to trigger the execution of an arbitrary library if clicked... an attacker would need to store a malicious library somewhere accessible by the targeted computer either on the system or on a remote share, and know its file path in advance.
「a002=[md5(systeminfo)]」「[ComputerName;UserName;CpuInfo;OS Version;SpyGlace Version]」
「cancel Remote shell」
SpyGlace acts as a backdoor, so operators can run commands and steal data.
「screenupload Upload screenshot」「screenauto Upload screenshot automatically」
A victim may receive a Proton Drive link leading to a RAR archive, or a malicious attachment directly in the email. Inside the archive is a Windows shortcut, or LNK file, whose opening begins the infection.
SpyGlace acts as a backdoor, so operators can run commands and steal data.
「statcounter…に対して一定間隔で通信」「リクエストヘッダー…Referer: ONLINE=>…」「C2サーバーとの通信にBASE64とRC4を使用…リクエストヘッダーのフォーマット…」
2026年の攻撃ではGitHubに加えて、GitLab、jsDelivr、Codebergが攻撃インフラとして悪用されていることを確認しています。
jsDelivrからファイルcontributing[1].txtをダウンロード ダウンロードしたcontributing[1].txtを検索、デコード、展開
179 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.