Practical Cyber Intelligence for Business Leaders in Non-Superpower Nations

APT-C-60 Expands Its Cloud Infrastructure — and the Defensive Playbook That No Longer Works

JPCERT/CC documents APT-C-60's expansion to four legitimate developer platforms as C2 infrastructure. DNS cache poisoning risk from BIND 9 vulnerabilities. Oracle patches 1,449 vulnerabilities in a single release. This week's incidents converge on one reality: the pace of attacker adaptation is outstripping the pace of defense.

APT-C-60 CONTINUES TARGETING JAPAN IN 2026 — A SOPHISTICATED ESPIONAGE CAMPAIGN HIDDEN BEHIND LEGITIMATE CLOUD SERVICES

The most significant threat to watch this week is the series of operations documented in a report published by JPCERT/CC on July 13, 2026, titled "On the Ongoing Targeted Attack Campaign Against Organizations in Japan by APT-C-60." JPCERT/CC refers to the group as APT-C-60, a designation also used in a 2021 research report by the QiAnXin Threat Intelligence Center. Some vendors in Japan also use the name SilverFox, but this newsletter follows JPCERT/CC's terminology.

Having spent more than two decades in this industry, I have repeatedly witnessed attackers growing more adaptive with each passing year. Reading this report only reinforced that reality. What concerns me most is that the pace of that adaptation consistently outstrips the pace of change on the defensive side.

At the core of this campaign is an initial compromise delivered via RAR files hosted on Proton Drive. In addition to GitHub, which had been observed in previous activity, the group has now been found to be simultaneously using three additional legitimate developer platforms — GitLab, jsDelivr, and Codeberg — as command-and-control infrastructure. All of these are widely used services within the developer community, making it extremely difficult to distinguish attacker traffic from legitimate business use based on external observation alone. The SpyGlace malware ultimately deployed in these intrusions has been updated from v3.1.15 to v3.1.18, according to version identifiers documented in the JPCERT/CC report, indicating that active development is ongoing.

To be specific about why this technique is operationally difficult to counter: the bulk of the communications are buried within HTTPS traffic to legitimate cloud services, which means that the traditional strategy of blocking destinations based on domain blocklists provides almost no meaningful defense. Proton Drive and GitHub are services that someone in your organization may be using for legitimate work today. A layered approach that combines behavioral detection with contextual analysis of network communications is essential — and whether your organization has the capability to execute that combination is a question being tested right now.

Multiple threat intelligence vendors have attributed APT-C-60 to a state-sponsored group, but I take a cautious position on treating attribution like this as a settled conclusion. More important than confirming attribution is asking how the continuity of these attacks and the speed of their evolution should be reflected in your defensive posture.

One pattern I have encountered repeatedly over more than two decades in this field is that sophisticated targeted attacks are typically discovered months after the initial compromise — or only after another organization's investigation surfaces the connection. This week brought several textbook examples of exactly that.

In the case of the malware infection affecting Japan Transit systems, data suspected to have been exfiltrated has already been confirmed to be circulating online. The incident involving a former employee at Aska Pharmaceutical, who took employee roster data when departing, only came to light as a result of a separate breach investigation into the organization where that individual was subsequently employed. In both cases, the organizations followed a structural pattern where internal monitoring alone either delayed discovery or left detection entirely dependent on an external trigger. I regard this not as a problem unique to any individual organization, but as a challenge shared across Japan's security landscape as a whole.

On top of these individual incidents, JPRS issued an urgent advisory this week calling for immediate action on BIND 9 vulnerabilities. The fixes address nine issues, including serious flaws capable of causing DNS cache poisoning. In the same week, Oracle released its quarterly patch bundle covering 1,449 vulnerabilities, and a critical update for Firefox ESR also landed.

Consider what this simultaneous convergence means for teams on the ground. The reality of a single security administrator — or a small team — at a mid-sized organization being expected to respond to all of this at once is a scene I have witnessed repeatedly throughout my career. When there is no time, no staff, and no capacity to apply patches, that is not negligence — it is a structural problem. The ongoing targeted campaign by APT-C-60 is aimed precisely at exploiting those gaps.

"We're a small company, so we won't be targeted" — I have lost count of how many times I have heard that. The incidents this week demonstrate once again how dangerous that assumption is.

Start by considering what it means for defenders when a threat actor suspected of operating with state-level resources uses legitimate cloud services as infrastructure. Proton Drive and GitHub are services that someone at your company may be using today. We are all — including small and mid-sized businesses — already operating in a world where the strategy of "block suspicious URLs" simply does not work.

The authentication bypass vulnerability in the WordPress SAML SSO plugin hits directly at the kinds of corporate websites and e-commerce platforms that small businesses commonly rely on. An authentication bypass vulnerability has been confirmed in miniOrange's "SAML Single Sign On" plugin. If exploited, an attacker can gain administrator-level access. That is not just a risk to customer data — it means your company's website could be weaponized as a launchpad for supply chain attacks. The assumption that "our site is too small to matter" can become the entry point that puts your business partners at risk.

The same logic applies to Microsoft SharePoint. CISA issued an urgent advisory this week confirming active exploitation of a SharePoint vulnerability in the wild. That warning is formally directed at U.S. government agencies, but there is no reason why Japanese organizations using the same products should consider themselves exempt.

The exploitation of vulnerabilities in Check Point SmartConsole also warrants attention. The fact that a security management product itself becomes the point of compromise is a fundamental challenge to the assumption that deploying a security product equals being protected. In my experience, it is not uncommon for security tools to become the responsibility of a single person after deployment, with logs that are never reviewed. What matters is not the number of tools you have, but the quality of how they are managed.

The incident with the strongest indicators of state involvement this week is the ongoing APT-C-60 campaign. I consistently prioritize asking "why" over asking "who," but this week both questions converge in a way that is difficult to separate.

The continued versioning of the SpyGlace malware points to the existence of organized development resources. It is operationally implausible for an individual or small criminal group to sustain this level of continuity in targeting specific Japanese organizations. The target sectors identified in the JPCERT/CC report — government-affiliated bodies, the defense industry, research institutions, and technology companies — make it clear that the objective is intelligence collection, not financial gain. My assessment is that this is a long-running, low-profile operation aimed at harvesting intellectual property and organizational communications.

The expansion of C2 infrastructure to include GitLab, jsDelivr, and Codeberg represents a deliberate diversification to evade detection. It is an adaptation specifically designed to circumvent the SOC tactic of blocklisting known malicious domains, and that speed of adaptation reflects the existence of an organized team with structured feedback loops. This is not a threat you can address once and move on. This group observes defensive responses and continuously adjusts its tactics, which means effective countermeasures require a sustained and structural commitment.

Regarding the exploitation of the Check Point SmartConsole vulnerability, the context of CISA's published advisory suggests potential state-sponsored actor involvement, though no specific attribution has been made public at this time. The motivation for targeting a security management platform is straightforward — it offers a potential pivot point into the entire network environment that product is designed to protect, making it an exceptionally high-value target. This is a case where response should not wait for attribution to be confirmed.

Practical defensive actions drawn from this week's incidents

① Apply the emergency patch for BIND 9 as your top priority. The fixes covered in this week's JPRS urgent advisory address nine vulnerabilities, including DNS cache poisoning. Verify the BIND 9 version running in your environment today and complete the update within 48 hours. If DNS operations are outsourced, contact your vendor today to confirm their remediation timeline. The downstream impact of a compromised DNS infrastructure affects the entire organization — this cannot be deferred.

② Begin an investigation into potential compromise of Check Point SmartConsole. Review authentication logs for administrative access over the past 30 days and look for any suspicious activity. Logs for management interface authentication are frequently overlooked, yet they represent one of the highest-value targets for attackers. If logging is not currently in place for these access points, that is itself a critical gap — address the configuration alongside the investigation.

③ Update Firefox ESR immediately across all managed endpoints. Exploit code for the critical vulnerabilities addressed in this week's update is already publicly available, which compresses the window between disclosure and active exploitation to near zero. A report of "it's been updated" is not sufficient — confirm that the update has actually been applied.

④ Ingest the APT-C-60 indicators of compromise and run a retrospective scan. Load the SpyGlace and APT-C-60 IoCs published in JPCERT/CC's July 13, 2026 report into your SIEM and EDR, and run a retrospective scan covering the past 90 days of logs. Pay particular attention to any access to Proton Drive, GitLab, jsDelivr, and Codeberg that falls outside normal business use. Even confirming the absence of suspicious activity provides meaningful situational awareness.

⑤ Audit any WordPress sites using SAML SSO plugins. If you are running miniOrange's "SAML Single Sign On" plugin, update to the latest version immediately and review administrative login authentication logs for any anomalous access. WordPress administration tends to become the responsibility of a single individual, which makes it easy for these checks to fall through the cracks — that is precisely the pattern attackers count on.

Next week, we continue tracking the evolving threat landscape — including any further developments on the APT-C-60 campaign targeting Japan and the exploitation of BIND 9 and SharePoint vulnerabilities. See you Friday.

Written by a Japan-based information security professional with over 20 years of experience, in collaboration with AI assistants.

© 2026 Samurai Cyber Watch. Redistribution with attribution permitted for non-commercial use.