South KoreaAssessedSouth Korea-alignedEspionageActive 2024 – 2026APT-C-60
Summary
Cyberespionage group that ESET describes as South Korea-aligned (the name is Qihoo 360's). In 2024 it exploited a WPS Office for Windows zero-day, CVE-2024-7262, against East Asian targets (T1203), delivering its SpyGlace backdoor. JPCERT/CC has reported its attacks on Japanese organisations three times: in August 2024 and again in June–August 2025 it posed as job seekers to recruitment staff, sending a Google Drive link and later an attached VHDX (T1566.002, T1566.001) whose LNK runs a script through a legitimate git.exe (T1204.002). Its downloaders persist by COM hijacking (T1546.015), check victims in through StatCounter and pull stages from Bitbucket and GitHub — joined in 2026 by GitLab, jsDelivr and Codeberg (T1102). In April 2026 ESET found a lure about an LDP political-finance scandal on a regional Japanese politician's machine; the LNK ran mshta.exe (T1218.005) to install RadialAgent, a downloader ESET says only APT-C-60 uses, probably as a stepping stone into wider networks of intelligence value. Microsoft's naming table lists APT-C-60 among the names for Zigzag Hail (DarkHotel); ESET and JPCERT/CC track it separately, and so does this record.
Attribution
ESET: South Korea-aligned; JPCERT/CC names no state; Microsoft files the name under Zigzag Hail
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- ESET Research (Research, 2024-08-28)
South Korea-aligned cyberespionage group
Campaigns 5
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Regional Japanese politicians — LDP-scandal LNK lures delivering RadialAgent | 2026-04 | Japan | Government, Political | ESET APT Activity Report Q2–Q3 2026 (2026-10-28) |
| Japanese organisations — Proton Drive lures, GitLab / jsDelivr / Codeberg staging, SpyGlace | 2026 – 2026-07 | Japan | Undisclosed | JPCERT/CC (2026-07-13) — attacks "observed in 2026"; end is the publication date |
| Fake job applicants to Japanese recruitment staff — attached VHDX, GitHub-hosted stages | 2025-06 – 2025-08 | Japan | Undisclosed | JPCERT/CC (2025-11-05) |
| Fake job applicant to a Japanese organisation — Google Drive VHDX, Bitbucket / StatCounterASSESSED | 2024-08 | Japan | Undisclosed | JPCERT/CC (2024-12-11) — "likely" APT-C-60 |
| WPS Office zero-day CVE-2024-7262 against East Asian targets — SpyGlace | 2024-02 – 2024-03 | East Asia | Undisclosed | ESET Research (2024-08-28) — exploit seen 29 Feb 2024; Kingsoft patched it silently in Mar 2024; ESET names East Asia, not the countries |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 7
| Initial Access2 | T1566.002Spearphishing LinkT1566.001Spearphishing Attachment |
|---|---|
| Execution2 | T1203Exploitation for Client ExecutionT1204.002Malicious File |
| Privilege Escalation1 | T1546.015Component Object Model Hijacking |
| Stealth1 | T1218.005Mshta |
| Command and Control1 | T1102Web Service |
Malware and tools 2
| Name | Description | Platform |
|---|---|---|
| SpyGlace | Backdoor | Windows |
| RadialAgent | Downloader | Windows |
Exploited vulnerabilities 1
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2024-7262 | 9.3 | Kingsoft WPS Office — code execution via crafted document (KEV 2024-09-03) |
Highest CVSS first.
Infrastructure patterns
- StatCounter used to check in infected devices before Bitbucket/GitHub stages are served (JPCERT/CC, 2024)
- Stages hosted on GitHub, GitLab, jsDelivr and Codeberg; Proton Drive used to deliver lures (JPCERT/CC, 2026)
- Lure emails sent from Proton Mail accounts (ESET, 2026)
Reporting and advisories 5
- ESET Research
Analysis of two arbitrary code execution vulnerabilities affecting WPS Office (Aug 2024) - JPCERT/CC
Attack Exploiting Legitimate Service by APT-C-60 (Dec 2024) - JPCERT/CC
Update on Attacks by Threat Group APT-C-60 (Nov 2025) - JPCERT/CC
Update on Attacks by Threat Group APT-C-60 in 2026 (Jul 2026) - ESET Research
ESET APT Activity Report Q2–Q3 2026 (Oct 2026)