Practical Cyber Intelligence for Business Leaders in Non-Superpower Nations

APT-C-60's Invisible Attack Chain — and the Week Japan's Critical Infrastructure Became a Target

APT-C-60 uses legitimate cloud services to hide in plain sight. Chubu Electric Power and Kyodo News hit in the same week. Autonomous ransomware removes the human operator from the equation entirely. This week's incidents signal that the threat landscape has shifted in ways that demand a fundamental rethink of defensive assumptions.

APT-C-60 CONTINUES TARGETING JAPAN IN 2026 — WHEN LEGITIMATE CLOUD SERVICES BECOME COVER

The development I am taking most seriously this week is the analytical report published by JPCERT/CC on July 13, 2026, titled "Ongoing Espionage Campaign by APT-C-60 Against Japanese Organizations."

Here is how the attack chain unfolds. A spearphishing email is delivered to a contact at the target organization. A link embedded in the message points to Proton Drive, where a RAR archive is downloaded. When extracted, an LNK file appears, and executing it ultimately deploys versions 3.1.15 through 3.1.18 of the malware known as SpyGlace on the victim's device. Data collected from the endpoint is then exfiltrated to the attacker's server via a GitHub repository. The sequence looks straightforward, but its sophistication lies precisely in the fact that nothing about it raises an obvious red flag.

What I am watching most closely is the use of GitHub, GitLab, jsDelivr, and Codeberg — all legitimate services — as command-and-control infrastructure. In modern development environments, blocking traffic to these platforms at the firewall is simply not practical. The attackers understand this reality and are deliberately blending their activity into traffic we already classify as trusted. Note that no CVE identifiers have been publicly assigned to the associated vulnerabilities at this time; I strongly recommend consulting the JPCERT/CC report directly.

The fact that multiple SpyGlace version numbers have been confirmed is also something I cannot overlook. Continuous tool updates indicate an organized development and operational structure behind the campaign. This is not an opportunistic, one-off attack. I assess it as part of a long-term intelligence-gathering operation by design.

With more than twenty years in this field, I can recall debates a decade ago in which some argued, with genuine seriousness, that the Japanese language barrier offered a degree of natural protection. Looking at the incidents that surfaced this week alone, there is no longer any room for that kind of optimism.

In the span of a single week, we saw the following: the ongoing APT-C-60 espionage campaign; unauthorized access to Chubu Electric Power and the exposure of contact information; unauthorized access to Kyodo News with the potential leak of staff and member-organization data; a customer data breach at EPARK Relax and Beauty; an authentication vulnerability in Takara Tomy's Duel Masters support app; and a personal data leak from the takeout ordering site operated by Miyamoto Munashi. As a one-week accumulation, this is not a volume that can be dismissed.

Of particular concern to me is the combination of Chubu Electric Power and Kyodo News. One is a critical infrastructure operator responsible for energy supply; the other is a media organization that delivers information to the public. The fact that both were targeted in the same week should not be written off as coincidence. Attacks on critical infrastructure do not mean only physical destruction. Seizing control over information flows and eroding the foundations of public trust are also valid objectives in the modern threat landscape.

The Takara Tomy case — in which an authentication vulnerability reportedly went unaddressed for approximately one year after the app's release — raises fresh questions about the maturity of Secure Development Lifecycle practices across Japanese organizations broadly. Is security review at the design stage being reduced to a formality in the push for faster delivery? This is a question every organization with a development function should be quietly asking itself this summer.

The autonomous ransomware cases confirmed this week are not solely a large-enterprise problem. The report published by Trend Micro Research on July 25, 2026, describes a new reality in which AI agents complete the full attack sequence — from initial intrusion through data encryption and destruction — without any human operator involvement.

Traditional ransomware attacks carried a meaningful operational cost. Attackers had to manually traverse networks, locate valuable data, and time the encryption. That human cost had the side effect of making small and mid-sized businesses relatively unattractive targets from a cost-benefit standpoint. As autonomous attacks become more prevalent, that economic barrier disappears. When the marginal cost of an attack approaches zero and attack operations can scale without limit, smaller organizations become equally viable targets. This could reasonably be called the democratization of threats.

The same logic applies to the TeamCity vulnerability that CISA confirmed as actively exploited on August 5, 2026. Small and mid-sized development firms and outsourced software shops that operate their own CI/CD pipelines — are they aware of the risk of being leveraged as a stepping stone in a supply chain attack? The Magecart-style attack on the Miyamoto Munashi takeout site is equally a scenario that could hit any small business relying on outsourced system management at any time.

What I want to convey to small business owners and operators with limited security resources is this: rather than aiming for perfect defense, aim to become a target that is not worth the attacker's effort. Specific steps toward that goal are outlined in the final section of this issue.

Multiple signals this week raise the possibility of state-sponsored threat actor involvement. Attribution immediately after an incident must be approached with caution — what follows is not a definitive conclusion, but technically and contextually grounded observation worth tracking.

The clearest case is APT-C-60 itself. The APT designation is a classification used specifically to describe state-sponsored groups, and JPCERT/CC's report confirms that this group continues to conduct organized espionage operations against Japanese organizations in 2026. The sustained version control of SpyGlace and the technical sophistication involved in using legitimate cloud services as C2 infrastructure represent a capability level not easily achieved by individual actors or small criminal groups.

The unauthorized access to Chubu Electric Power has not yet been attributed to a specific actor. However, in my experience, the choice to target critical infrastructure in the energy sector is more consistent with the strategic intent of nation-state actors than with financially motivated criminal groups. Information about the stability of power supply and the configuration of grid assets carries potential intelligence value as a resource for decision-making in crisis scenarios.

The attack on Kyodo News also warrants close attention. News organizations possess networks of sources, pathways to unpublished government and corporate information, and significant power to shape public information flows. These characteristics have long made media outlets a preferred target for state-sponsored cyber espionage. What we can state with confidence at this point is that signals exist that justify treating state involvement as a hypothesis — definitive conclusions must await further technical investigation.

Practical defensive actions drawn from this week's incidents

① Apply patches to TeamCity and Apache Tomcat now. The vulnerabilities that CISA confirmed as actively exploited between August 4 and 5, 2026, are already incorporated into attacker toolkits. For the relevant CVE identifiers, consult CISA's Known Exploited Vulnerabilities catalog and your vendor's security advisories directly. Entering an extended holiday period with patches unapplied is the equivalent of leaving your front door unlocked while you are away. Check the patch status of your CI/CD pipeline and web application servers today.

② Establish and document a formal verification process within your organization for cloud storage links received via email. APT-C-60 is using Proton Drive links to distribute LNK files. The instinct that a link from a legitimate service must be safe is exactly the entry point SpyGlace exploits. Implement a procedure — particularly for senior executives and HR and administrative staff — that requires verifying the sender by phone or a separate communication channel before opening any unexpected link.

③ Monitor outbound traffic to GitHub and GitLab from a data loss prevention perspective. APT-C-60 is using these legitimate platforms as exfiltration channels. Blocking them outright is not realistic; enhanced monitoring is. Consider configuring alerts for outbound transmissions that occur at unusual hours, involve unexpected file types, or reflect data volumes inconsistent with normal development activity.

④ Conduct integrity verification on the payment forms and API endpoints of any web services or applications your organization operates. As the Miyamoto Munashi and EPARK Relax and Beauty cases illustrate, Magecart-style attacks against e-commerce and reservation platforms are an active and ongoing threat. Confirm that change detection is functioning for payment-related JavaScript and APIs, including in systems managed by third parties on your behalf.

⑤ Review your behavioral detection configuration. The autonomous ransomware described in the Trend Micro Research report cannot be detected by known indicators of compromise or traditional signatures. Verify that behavioral detection capabilities are enabled in your endpoint protection product and that machine learning-based detection is running on its current model. A security posture that depends solely on signature updates will not hold against the attacks confirmed this week — that is one of the most important lessons twenty years in this field has taught me.

Next week, we continue tracking the evolving threat landscape — including any further developments on the APT-C-60 campaign and the Cisco FMC zero-day patch status. See you Friday.

Written by a Japan-based information security professional with over 20 years of experience, in collaboration with AI assistants.

© 2026 Samurai Cyber Watch. Redistribution with attribution permitted for non-commercial use.