CNCMachineRMS RAT, Lazarus Operation Dream Job Zero-Day & APT-C-60 SpyGlace: OTX Pulse Analysis — Enterprise Detection Pack | Security Arsenal

Three concurrent OTX pulses published 2026-08-12 paint a picture of a maturing intrusion economy in which social engineering lures — not exploit kits — are now the primary delivery vehicle for state-grade and crimeware-grade implants.

Pulse 1 — CNCMachineRMS / BabaDeda (Unknown Actor, Crimeware-Grade): LevelBlue SpiderLabs researchers documented a previously undocumented remote administration trojan delivered at the end of a multi-stage BabaDeda loader chain. The infection begins with a ClickFix lure — the increasingly dominant technique where victims are socially engineered into pasting and executing attacker-supplied commands themselves. The chain then abuses a legitimately signed IBM SPSS IDE binary to sideload malicious code, using four decoy DLLs and a legitimate date-formatting API as an execution trampoline. The final payload, CNCMachineRMS, is a 1.14 MB x64 implant with no import table and runtime-constructed strings — a deliberate anti-analysis design that defeats static signature scanning and basic import-based detection.

Pulse 2 — Lazarus "Shattering the Dream" (DPRK-Attributed): Check Point Research attributes a new evolution of Operation Dream Job to Lazarus, targeting defense and aerospace employees with fraudulent job offers. This iteration escalates from social engineering to a zero-day attack (CVE-2026-68820), supported by additional exploited vulnerabilities (CVE-2024-38193, CVE-2025-49113, CVE-2025-60719). The toolset spans FudModule (known for bring-your-own-vulnerable-driver EDR tampering), MISTPEN, SecurityPDF, RelayShell, and ForestTiger — consistent with DPRK objectives of defense industrial espionage and revenue generation.

Pulse 3 — APT-C-60 2026 Update (JPCERT/CC): APT-C-60 continues sustained operations against Japanese organizations using spear-phishing emails carrying Proton Drive links or RAR attachments. Victims extract LNK files that invoke mshta.exe to execute JavaScript, triggering a multi-stage SpyGlace deployment. The group heavily abuses legitimate infrastructure — GitHub, GitLab, and jsDelivr — for staging, making network-layer blocking operationally painful and reputation-filtering largely ineffective.

Collective signal: All three campaigns converge on the same doctrine — live off the land, abuse signed binaries and trusted SaaS/CDN infrastructure, and let the victim initiate execution. Perimeter trust models built on domain reputation and signature validation are structurally blind to this class of attack.

Threat Actor / Malware Profile

CNCMachineRMS (BabaDeda Chain)

Distribution: ClickFix social engineering lure; victim manually executes the initial command.
Loader: BabaDeda staged through a legitimately signed IBM SPSS IDE executable, with four decoy DLLs and a date-formatting API abused as an execution trampoline (DLL sideloading / proxy execution).
Payload behavior: 1.14 MB x64 RAT implant providing remote operator control of compromised hosts.
Anti-analysis: Zero imports (all API resolution at runtime), runtime-built strings — defeats static analysis, YARA string signatures, and import-hash (imphash) pivoting.
C2: Operator-driven RAT channel established post-staging; network indicators must be pulled from dynamic analysis given the static obfuscation.

Lazarus — Operation Dream Job (Shattering the Dream)

Distribution: Spear-phishing job offers aimed at defense and aerospace personnel; fake recruiter personas and document lures.
Exploitation: CVE-2026-68820 zero-day, plus CVE-2024-38193, CVE-2025-49113, and CVE-2025-60719 — patch posture on these CVEs is now a hard requirement for targeted sectors.
Toolset: FudModule (BYOVD-style EDR/security-product tampering), MISTPEN, SecurityPDF (document-themed implant), RelayShell (proxy/relay C2), ForestTiger.
Persistence: Lazarus historically combines scheduled tasks, services, and registry run keys; FudModule's presence indicates deliberate security-control degradation before persistence establishment.
Objective: Defense/aerospace intellectual property theft and DPRK revenue operations.

APT-C-60 — SpyGlace

Distribution: Spear-phishing to Japanese organizations via Proton Drive links or RAR archives containing malicious LNK files.
Execution chain: LNK → mshta.exe → JavaScript → multi-stage SpyGlace delivery.
C2 / staging abuse: GitHub, GitLab, and jsDelivr abused for payload hosting and retrieval — encrypted HTTPS to high-reputation domains.
Technique profile: Living-off-the-land (LOLBins), legitimate service abuse, multi-stage in-memory delivery to minimize disk artifacts.

IOC Analysis

The pulses collectively contain 171 indicators, dominated by file hashes:

FileHash-SHA256 / SHA1 / MD5 (~167 indicators): Hashes for CNCMachineRMS, BabaDeda stages, decoy DLLs, Lazarus tooling (FudModule, MISTPEN, SecurityPDF, RelayShell, ForestTiger), and SpyGlace stages. Hashes are your highest-confidence, lowest-false-positive indicators — push them into EDR blocklists and retro-hunt immediately. Note that runtime-built strings and no-import design (CNCMachineRMS) mean hash matching may be your only static signal for that family.
CVE indicators (4): CVE-2026-68820 (zero-day), CVE-2024-38193, CVE-2025-49113, CVE-2025-60719. These are vulnerability-management IOCs — operationalize via asset inventory queries and emergency patching, not SIEM rules.
Behavioral indicators (implicit): The pulses carry more detection value in their TTP descriptions than raw IOCs — ClickFix paste-execution, IBM SPSS IDE sideloading, mshta.exe spawning JavaScript from LNK files, and HTTPS beaconing to github.com/gitlab.com/jsdelivr.net paths.

Operationalization guidance:

Ingest hashes into your EDR/TIP within the hour; SHA256 values are the priority tier.
Because CNCMachineRMS builds strings at runtime, do not rely on string-based YARA alone — combine hash blocking with behavioral rules (below).
For APT-C-60's legitimate-service abuse, deploy TLS-aware proxy logging or DNS query logging with full URL paths (via proxy, not DNS alone) so github.com/jsdelivr requests can be correlated against process lineage.
CVEs should be cross-referenced against your vulnerability scanner output for defense/aerospace-adjacent business units immediately.

Detection Engineering

YAML

---
title: ClickFix-Style User-Initiated Script Execution Leading to Sideload Chain
description: Detects execution patterns consistent with ClickFix lures delivering BabaDeda/CNCMachineRMS — script interpreters or signed IDE binaries spawning unexpected child processes or loading unsigned DLLs
status: experimental
date: 2026/08/12
author: Security Arsenal Threat Intelligence
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent_lolbin:
        ParentImage|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\mshta.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
    selection_clipboard_style_cmd:
        CommandLine|contains:
            - 'mshta http'
            - 'curl '
            - 'Invoke-WebRequest'
            - 'iwr '
            - 'certutil -urlcache'
            - 'pastebin'
            - 'iex('
    condition: selection_parent_lolbin and selection_clipboard_style_cmd
falsepositives:
    - IT administrative scripting; correlate with user-initiated (interactive session) context and recent browser activity
level: high
tags:
    - attack.execution
    - attack.t1059
    - attack.t1204
---
title: Suspicious DLL Sideloading via Signed Binary (BabaDeda / CNCMachineRMS Pattern)
description: Detects legitimately signed application binaries (e.g., IBM SPSS IDE pattern) executing from non-standard directories, indicative of DLL sideloading trampoline chains
status: experimental
date: 2026/08/12
author: Security Arsenal Threat Intelligence
logsource:
    category: process_creation
    product: windows
detection:
    selection_signed_apps:
        Image|endswith:
            - '\stats.exe'
            - '\spss.exe'
            - '\javaw.exe'
            - '\java.exe'
    filter_standard_paths:
        Image|startswith:
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
    condition: selection_signed_apps and not filter_standard_paths
falsepositives:
    - Portable application installations; validate signer and directory provenance
level: medium
tags:
    - attack.defense_evasion
    - attack.t1574.002
    - attack.t1218
---
title: APT-C-60 LNK to Mshta JavaScript Execution Chain
description: Detects LNK-initiated mshta.exe execution of JavaScript, the documented APT-C-60 SpyGlace delivery chain abusing Proton Drive, GitHub, GitLab, and jsDelivr staging
status: experimental
date: 2026/08/12
author: Security Arsenal Threat Intelligence
logsource:
    category: process_creation
    product: windows
detection:
    selection_mshta:
        Image|endswith: '\mshta.exe'
    selection_network_staging:
        CommandLine|contains:
            - 'http://'
            - 'https://'
            - 'javascript:'
            - '.hta'
            - 'raw.githubusercontent'
            - 'gitlab.com'
            - 'cdn.jsdelivr'
            - 'proton.me'
            - 'protondrive'
    condition: selection_mshta and selection_network_staging
falsepositives:
    - Rare legitimate HTA enterprise applications; baseline before deployment
level: critical
tags:
    - attack.execution
    - attack.t1218.005
    - attack.t1102

KQL — Microsoft Sentinel / Defender

// Hunt: SpyGlace / BabaDeda staging over legitimate services + LNK/mshta execution
// Microsoft Sentinel / Defender XDR
let Lookback = 14d;
let SuspiciousStaging = dynamic(["raw.githubusercontent.com", "gitlab.com", "cdn.jsdelivr.net", "drive.proton.me"]);
let ProcEvents =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName =~ "mshta.exe"
       or (FileName in~ ("powershell.exe","wscript.exe","cscript.exe")
           and ProcessCommandLine has_any ("iex(", "Invoke-WebRequest", "iwr ", "certutil -urlcache"))
    | project ProcTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, DeviceId, ProcessId;
let NetEvents =
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteUrl has_any (SuspiciousStaging)
    | where InitiatingProcessFileName in~ ("mshta.exe","powershell.exe","wscript.exe","cscript.exe","rundll32.exe","regsvr32.exe","java.exe","javaw.exe")
    | project NetTime=TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, DeviceId, InitiatingProcessId;
ProcEvents
| join kind=inner NetEvents on DeviceId
| where abs((ProcTime - NetTime) / 1m) <= 10
| project ProcTime, DeviceName, AccountName, FileName, ProcessCommandLine, RemoteUrl, RemoteIP
| order by ProcTime desc

PowerShell

# Security Arsenal - OTX Pulse IOC & Artifact Hunt (CNCMachineRMS / BabaDeda / SpyGlace / Lazarus DreamJob)
# Run elevated on suspected endpoints or deploy via your RMM/EDR scripting module

$ErrorActionPreference = 'SilentlyContinue'
$Report = @()

# --- 1. Known-bad SHA256 hashes (sample from OTX pulses) ---
$BadHashes = @(
    'b804b9dd2726e69fb4f496a6872f90edf9146ad8044c6d3a592040ce1074a5d0',  # CNCMachineRMS chain
    '5b71b49bad415643ff3e291ee3ba550e5edfd584eb913859dadb81634450e7e7',
    '3d4e7187f74de912f9d52f5ba6a95bd41868348b16583d72957d732c0ed8f0e7',
    '13d10bc99f7f7abe7ee0902be87920b73b2ea41bd9683dbfcad340dacbcdef79',  # Lazarus DreamJob tooling
    '1de949c71efcfb0ffc41f33d38833dbc4b082075b1a540fc68c18c535d7ad86c',
    '002e1207b96361fc4d53b10621225d61700003241fa38caacb411384b3d51135'   # APT-C-60 SpyGlace
)

# --- 2. Hash sweep of high-risk staging directories ---
$SearchPaths = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA\Temp", "$env:USERPROFILE\Downloads", "C:\ProgramData")
foreach ($Path in $SearchPaths) {
    Get-ChildItem -Path $Path -Recurse -File -Include *.exe,*.dll,*.js,*.hta,*.lnk -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
        if ($BadHashes -contains $h) {
            $Report += [PSCustomObject]@{Type='MALICIOUS_HASH_HIT'; Path=$_.FullName; Hash=$h}
        }
    }
}

# --- 3. Persistence: Run keys with script interpreters or odd paths ---
$RunKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($Key in $RunKeys) {
    Get-ItemProperty -Path $Key | ForEach-Object {
        $_.PSObject.Properties | Where-Object {
            $_.Value -match 'mshta|wscript|cscript|powershell|rundll32|regsvr32|Temp|AppData'
        } | ForEach-Object {
            $Report += [PSCustomObject]@{Type='SUSPICIOUS_RUNKEY'; Path="$Key\$($_.Name)"; Hash=$_.Value}
        }
    }
}

# --- 4. Scheduled tasks invoking LOLBins (Lazarus/APT-C-60 persistence pattern) ---
Get-ScheduledTask | ForEach-Object {
    $actions = $_.Actions | Out-String
    if ($actions -match 'mshta|wscript|cscript|powershell.*-(e|enc)|javascript') {
        $Report += [PSCustomObject]@{Type='SUSPICIOUS_SCHEDTASK'; Path=$_.TaskName; Hash=$actions.Trim()}
    }
}

# --- 5. Active network connections to abused legitimate staging services ---
$StagingDomains = 'github|gitlab|jsdelivr|proton'
Get-NetTCPConnection -State Established | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess
    if ($proc.ProcessName -match 'mshta|powershell|wscript|cscript|java|rundll32') {
        try {
            $dns = (Resolve-DnsName $_.RemoteAddress -ErrorAction Stop).NameHost
            if ($dns -match $StagingDomains) {
                $Report += [PSCustomObject]@{Type='LOLBIN_NET_TO_STAGING'; Path="$($proc.ProcessName) (PID $($_.OwningProcess)) -> $dns ($($_.RemoteAddress))"; Hash=''}
            }
        } catch {}
    }
}

# --- 6. Recent LNK files in Downloads (APT-C-60 RAR/LNK lure artifact) ---
Get-ChildItem "$env:USERPROFILE\Downloads" -Filter *.lnk -ErrorAction SilentlyContinue |
    Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-14) } | ForEach-Object {
        $Report += [PSCustomObject]@{Type='RECENT_LNK_LURE'; Path=$_.FullName; Hash="Created: $($_.CreationTime)"}
    }

if ($Report.Count -gt 0) {
    Write-Host "[!] $($Report.Count) suspicious artifacts found:" -ForegroundColor Red
    $Report | Format-Table -AutoSize
    $Report | Export-Csv -Path "$env:TEMP\otx_hunt_results_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
} else {
    Write-Host "[+] No indicators from 2026-08-12 OTX pulses detected." -ForegroundColor Green
}

Response Priorities

Immediate (0-4 hours):

Push all SHA256 indicators from the three pulses into EDR blocklists and email/web gateway detonation feeds; prioritize the CNCMachineRMS chain hashes given the family is undocumented and may be broadly distributed.
Block or alert on proxy logs for cdn.jsdelivr.net, raw.githubusercontent.com, and drive.proton.me requests initiated by script interpreters — do not blanket-block the domains.
Hunt for mshta.exe with URL-bearing command lines and for signed binaries executing from non-Program Files paths (rules above).
For defense/aerospace business units: treat CVE-2026-68820 as an emergency patch event; verify coverage for CVE-2024-38193, CVE-2025-49113, and CVE-2025-60719.

24 Hours:

If any endpoint shows ClickFix-style execution or Dream Job lure exposure, assume credential compromise: force password resets and revoke active sessions/tokens for affected users. Both Lazarus tooling and RAT implants of CNCMachineRMS's class routinely harvest browser and cached credentials.
Review MFA posture on affected accounts — phishing-resistant MFA (FIDO2) materially blunts credential replay from RAT-exfiltrated secrets.
Retro-hunt 14 days of process telemetry using the KQL query across all Japanese subsidiaries and defense/aerospace-adjacent units.
Inspect EDR health: FudModule's BYOVD pattern means an endpoint with a mysteriously stopped or degraded sensor is itself an indicator.

1 Week:

Deploy application control (WDAC/AppLocker) rules blocking mshta.exe, wscript.exe, and cscript.exe for standard users — all three campaigns depend on script-interpreter LOLBins.
Restrict LNK execution from email-extracted archives; enable MOTW propagation and block child processes from archive utilities.
Harden against ClickFix: user awareness briefings specifically on "paste this command" lures, plus browser policies blocking clipboard-injection patterns where supported.
Establish egress policy requiring business justification for endpoint access to code-hosting/CDN staging paths outside developer roles.
For Japan-facing organizations: brief regional SOC staff on the APT-C-60 TTP set and pre-stage the JPCERT indicator set (100 IOCs) for continuous matching.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

CNCMachineRMS RAT, Lazarus Operation Dream Job Zero-Day & APT-C-60 SpyGlace: OTX Pulse Analysis — Enterprise Detection Pack