Practical Cyber Intelligence for Business Leaders in Non-Superpower Nations

APT-C-60's Infrastructure Now Hides Inside the Tools Your Developers Use Every Day

JPCERT/CC documents how APT-C-60 has embedded GitHub, GitLab, and Proton Drive into its attack chain — rendering traditional perimeter defense blind. A supply chain attack via npm. Healthcare and agricultural manufacturers hit as supply chain targets. This week's incidents mark a genuine inflection point: the trusted service is now the threat vector.

APT-C-60 CONTINUES TARGETED ATTACKS AGAINST JAPANESE ORGANIZATIONS USING LEGITIMATE CLOUD SERVICES AS COVER

When I read the analytical report published by JPCERT/CC Eyes on July 13, 2026, titled "Continued Targeted Attacks Using SpyGlace by APT-C-60," my first reaction was a quiet sense of: so it has finally come to this.

APT-C-60 is an East Asia-linked APT group that 360 Threat Intelligence and multiple international security researchers have tracked for years. Since 2024, the group has been known for its particularly relentless targeting of organizations in Japan. Even into 2026, spear-phishing emails remain the group's primary intrusion vector. What the JPCERT/CC Eyes report makes unmistakably clear, however, is that the attack infrastructure has evolved significantly.

Previously, this group relied primarily on Bitbucket as its C2 server. Now, according to the report, it has distributed that function across three legitimate developer platforms: GitHub, GitLab, and Codeberg. It has also incorporated Proton Drive as a malware delivery channel, effectively neutralizing corporate URL filtering and proxy controls. In short, the group has embedded everyday, trusted business services into the very foundation of its attack operations.

The JPCERT/CC report identified multiple variants of the deployed malware, SpyGlace, ranging from version v3.1.15 through v3.1.18, suggesting an active and sustained development cycle. In my more than two decades working in this industry, the point at which a threat actor's infrastructure becomes this deeply dependent on legitimate services marks a genuine inflection point for defenders — one where traditional perimeter-based security fundamentally breaks down. Right now, your organization's logs almost certainly contain outbound connections to GitHub. Can you immediately determine whether each of those connections represents legitimate development activity or C2 communication? For most organizations, I suspect the honest answer is no.

My concern about this incident runs deeper than the technical details, and it is rooted in both the organizational culture and the practical realities facing Japanese institutions.

Many Japanese companies and government agencies have effectively placed well-known services such as GitHub and Google Drive on an implicit whitelist. From the perspective of development efficiency and cost optimization, that was a reasonable call. But APT-C-60 is exploiting precisely that assumption. The unstated belief that "traffic to trusted destinations is safe" has become one of the most significant vulnerabilities in the modern defensive posture.

There is a structural problem compounding this. In Japan, organizations capable of running an in-house Security Operations Center remain largely limited to large enterprises. Yet mid-sized companies, regional governments, and healthcare institutions — all realistic targets for APT-C-60 — frequently lack even the basic log analysis infrastructure needed to detect this kind of activity. If you are reading JPCERT/CC advisories and filing them away as "relevant only to large corporations," I would urge you to abandon that habit immediately.

It also remains true that the last line of defense against spear-phishing-based initial access is still the human being receiving the email. Rebuilding a layered defense that combines technical controls with sustained user education is no longer a priority that can be deferred.

If you are operating under the assumption that a threat actor of APT-C-60's caliber would have no interest in a company your size, I want to be direct: that assumption is dangerous in 2026.

Looking across this week's incidents as a whole, a clear shift in attacker targeting logic is visible. The breach of a third-party system handling patient and healthcare worker data for Asahi Kasei Therapeutics, and the malware infection publicly disclosed by Daisen, an agricultural greenhouse manufacturer — both cases involved mid-sized companies occupying key positions in larger supply chains, and both took direct hits.

For threat actors, small and mid-sized businesses carry a dual kind of value. First, they frequently serve as suppliers or subcontractors to large enterprises, making them potential pivot points into more valuable networks. Second, their comparatively weaker defenses mean the cost of intrusion is lower, and monetization through ransomware is more straightforward. Targeting the periphery of a large organization is simply more cost-effective than attacking its core — and attackers operate on that logic without sentiment.

This week's confirmed npm supply chain attack distributing a Linux implant dubbed RedC2 must be read in the same context. npm is the package manager widely used in JavaScript development, the mechanism through which developers routinely pull external code into their projects. Any organization with even a single developer on staff cannot rule out the possibility that that engineer's workstation could become the origin point of a supply chain compromise. The era in which business leaders could treat cybersecurity as the IT department's problem — quietly, but definitively — is over.

From a state-actor perspective, the development most warranting attention this week is APT-C-60's continued targeted campaign against Japanese organizations.

APT-C-60 has been tracked by 360 Threat Intelligence and multiple security researchers as an East Asia-linked APT group. The consistency of its targeting, the clarity of its objectives, and the sophistication of its tradecraft have led to widespread assessment that some level of state or state-affiliated resourcing and involvement is present. I am not in a position to attribute this to a specific nation-state, but three points are worth recording as objective observations.

First, the group's target selection has remained persistently focused on organizations within Japan, with a degree of tenacity that is difficult to explain through economic motivation alone. Second, the ongoing versioning of SpyGlace implies an organized development operation — not an improvised effort. Third, the distribution of C2 infrastructure across GitHub, GitLab, and Codeberg is a deliberate architectural choice designed to resist single-platform takedowns, and is most naturally read as a strategic decision premised on long-term operations. Taken together, these three points do not paint a picture consistent with opportunistic criminal activity.

Also confirmed this week: CISA validated active exploitation of vulnerabilities in macOS, Microsoft SharePoint, and VMware vCenter. Some of these exploits require a high level of technical capability, and state-actor involvement cannot be fully excluded. For defenders, the practical approach is to delegate the question of attribution to intelligence agencies and focus organizational energy on detection and containment — on what is being done, not only on who is doing it.

Practical defensive actions drawn from this week's incidents

① Make C2 communications to GitHub, GitLab, and Proton Drive visible in your logs. Given APT-C-60's documented tradecraft, if your organization unconditionally permits outbound traffic to these services, configure logging at the URL path and parameter level and establish anomaly detection rules this week. The first step is not blocking — it is visibility.

② Prioritize patching NetScaler ADC and NetScaler Gateway. Authentication bypass vulnerabilities in VPN infrastructure represent a breach of the outermost defensive perimeter. Organizations that cannot commit the resources to patch immediately should implement temporary access restrictions to reduce exposure while a remediation plan is developed.

③ Deploy Conditional Access policies and Continuous Access Evaluation in your Microsoft 365 environment. This week reinforced, once again, that MFA alone is insufficient protection against AiTM phishing — attacks that intercept communications in transit to steal session tokens. Combining device compliance checks with detection of sessions originating from anomalous IP addresses is the recommended configuration.

④ Review the npm package intake process in your development environments. Using the RedC2 distribution method as a reference, audit the process your internal development teams use to verify the provenance and legitimacy of packages. Specifically, introduce operational checks on download volume, publication date, and maintainer information for recently added dependencies.

⑤ Obtain written confirmation of the security posture of your vendors and subcontractors. The Asahi Kasei Therapeutics incident and the Daisen malware infection both exposed weaknesses in third-party risk management. Verify this week whether your contracts with vendors handling sensitive data explicitly define incident reporting obligations and minimum security requirements. Your organization's risk extends into environments you do not directly control.

Next week, we continue tracking the evolving threat landscape — including any further developments on the APT-C-60 campaign and active exploitation of SharePoint and VMware vCenter vulnerabilities. See you Friday.

Written by a Japan-based information security professional with over 20 years of experience, in collaboration with AI assistants.

© 2026 Samurai Cyber Watch. Redistribution with attribution permitted for non-commercial use.