The Evolution of Cyberattacks: Abusing Trust to Evade Detection

Cybercriminals are continually refining their tactics, leveraging trusted platforms to infiltrate corporate networks and deliver malicious payloads. A recent campaign orchestrated by APT-C-60, a sophisticated threat actor, demonstrates just how advanced and insidious these attacks have become.

In a targeted campaign focused on organizations in Japan and East Asia, APT-C-60 employed a clever combination of social engineering, trusted services, and multi-stage infection techniques to bypass traditional security measures. This attack serves as a stark reminder of how threat actors exploit the trust placed in legitimate platforms like Google Drive, Bitbucket, and StatCounter to deliver malware undetected.

The Anatomy of the Attack

The attack campaign was first detected in August 2024 and began with a phishing email disguised as a job application sent to organizational recruitment contacts. This email contained what appeared to be an innocent Google Drive link, but clicking on it triggered a dangerous sequence of events.

1. Weaponized Google Drive Links:
   The initial link led victims to download a VHDX file—a virtual disk format often seen as legitimate and harmless. Inside this file were decoy documents alongside malicious components, including:
   • A Windows shortcut file (LNK), which acts as the initial trigger.
   • A downloader file named SecureBootUEFI.dat, cleverly disguised to appear legitimate.
2. Malicious Techniques for Persistence:
   • Once executed, the downloader connected to StatCounter, a legitimate web analytics service, to send unique device identifiers. By doing this, attackers effectively tracked and managed infected systems while blending their activity into regular network traffic.
   • The downloader then fetched additional payloads from Bitbucket, a popular code-hosting platform, to continue the infection chain.
3. Final Payload and Backdoor Installation:
   At the final stage, the malware downloaded two key components (cn.dat and sp.dat) and deployed a backdoor called SpyGrace (version 3.1.6). SpyGrace enabled attackers to:
   • Steal files and sensitive data.
   • Load additional plugins for malicious functionality.
   • Execute arbitrary commands to maintain long-term control over compromised devices.
4. Advanced Persistence Techniques:
   To ensure the malware remained undetected and operational, attackers used COM hijacking—a method that exploits legitimate Windows processes for persistence, making it harder for security tools to identify the threat.

The Risks: Why This Attack Matters

This campaign is alarming for several reasons:

• Abuse of Trusted Platforms: Google Drive, Bitbucket, and StatCounter are widely trusted by users and security tools. This trust allows attackers to bypass traditional filters and detection systems.
• Multi-Stage Evasion: The attack’s complexity, involving virtual disk files, LNK shortcuts, and legitimate tools for persistence, highlights how cybercriminals are becoming more strategic and evasive.
• Targeting Corporate Networks: By impersonating job applicants and targeting recruitment teams, attackers exploit one of the most human-centric entry points of any organization.

These tactics are part of a broader trend where Advanced Persistent Threats (APTs) leverage social engineering and trusted platforms to infiltrate networks undetected. Traditional security tools, which rely on static rules, signatures, or manual triage, often fail to detect such attacks until significant damage has occurred.

How CyTwist Stops Advanced Threats Like APT-C-60

At CyTwist, we understand that modern cyber threats demand a modern approach. Our advanced malware detection platform is purpose-built to identify stealthy, multi-stage attacks like the one used by APT-C-60.

The diagram below highlights CyTwist’s detection points across the attack lifecycle giving you visibility and actionable insights to stop attackers in their tracks. Detection points marked by a lizard in a red circle.

🔍 Our platform excels in:

• Early Detection Across the Attack Chain: CyTwist detects malicious activity at every stage—from initial infiltration to persistence—by analyzing behavioral patterns and spotting stealth progression missed by traditional tools.
• Identifying Weaponized Trusted Services: CyTwist can pinpoint malicious activity hidden within trusted platforms like Google Drive or Bitbucket, ensuring attackers can’t exploit these blind spots.
• Near-Zero False Positives: Our AI-driven detection engine eliminates noise, ensuring that security teams focus on real threats without alert fatigue.
• Rapid Mitigation: Once detected, CyTwist provides actionable insights for immediate response, including automated containment and threat neutralization through the EDR.

With CyTwist, organizations gain unparalleled visibility and protection against the most sophisticated attacks, ensuring that trusted platforms can no longer be exploited as entry points.

Conclusion: Stay One Step Ahead of Advanced Threats

The APT-C-60 campaign underscores the growing need for organizations to adopt proactive and AI-driven advanced security solutions. As attackers evolve and exploit trusted platforms to deliver malware, relying on outdated detection methods is no longer sufficient.

At CyTwist, we’re helping organizations detect the undetectable—identifying stealth malware, stopping multi-stage attacks, and preventing persistent threats before they escalate.

The future of cybersecurity demands smarter, faster, and more adaptive solutions.
Contact us to learn more about how CyTwist protects against today’s most advanced cyber threats.