Full Report
The Jewelbug hacker group has been carrying out espionage operations targeting governments and militaries while also engaging in cryptocurrency fraud. [...]
Analysis Summary
# Threat Actor: Jewelbug
## Attribution & Identity
* **Name/Alias:** Jewelbug
* **Known Aliases:** Earth Alux, REF7707
* **Origin:** China-based.
* **Associations:** Symantec attributes the financially motivated operations to a specific Chinese company that publicly advertises SEO (Search Engine Optimization) services. The actor likely operates as a "hack-for-hire" group or a dual-purpose organization conducting both state-aligned espionage and private cybercrime.
## Activity Summary
Jewelbug has recently executed a sophisticated dual-track campaign. One track focused on high-level espionage against 15 government tenants in a Middle Eastern country by compromising a shared webmail platform. Simultaneously, the group operated a massive "industrial-scale" cryptocurrency fraud business using AI-generated content and SEO manipulation to lure victims to fraudulent exchange sites.
## Tactics, Techniques & Procedures
* **Watering Hole / Webmail Injection:** Gained write access to a shared webmail installation to inject malicious scripts into common templates, affecting all users upon login.
* **WebSocket C2:** Uses WebSockets to establish persistent connections between the victim’s browser and the attacker's server for cookie exfiltration.
* **Social Engineering:** Delivers payloads via fake Adobe Flash or Adobe installer prompts.
* **Living off Trusted Services:** Uses public Google Docs to host obfuscated payloads, allowing malicious traffic to blend with legitimate cloud service traffic.
* **SEO Manipulation:** Employs click-fraud bots and AI-generated articles to promote fraudulent cryptocurrency domains in search engine rankings.
* **Technical MITRE ATT&CK Mapping (Inferred):**
* T1553.003 (Subvert Trust Controls: App Rooting)
* T1189 (Drive-by Compromise)
* T1071.001 (Application Layer Protocol: Web Protocols)
* T1567 (Exfiltration Over Web Service)
## Targeting
* **Sectors:** Government, Military, Telecommunications, Defense, Education, and Aviation.
* **Geography:** Primarily the Middle East, Southeast Asia, and South Asia.
* **Victims:** 15 government tenants in the Middle East; state telecommunications and military networks in Southeast Asia.
## Tools & Infrastructure
* **Antino:** The primary Windows backdoor used for persistent access and payload deployment.
* **XG-Web:** A remote-access and data-theft framework used to manage campaigns and victim databases.
* **PDF Viewer (Malicious Extension):** A custom browser extension for Chrome and Firefox designed to steal cookies, intercept traffic, and inject JavaScript.
* **ClientKing:** A Rust-based implant targeting Linux, ARM64 devices, and ASUS routers; supports DNS tunneling and SOCKS proxying.
* **Infrastructure:** A fleet of 44 content-management servers and hundreds of lookalike domains (e.g., impersonating binance[.]com or okx[.]com).
## Implications
Jewelbug represents a blurring of the line between state-sponsored espionage and organized cybercrime. Their ability to compromise national-level service providers (telecoms/hosting) to reach multiple government agencies simultaneously demonstrates a high level of operational maturity. The use of AI to scale fraud operations suggests they are early adopters of automation to increase the ROI of their criminal enterprises.
## Mitigations
* **Webmail Integrity:** Implement integrity checking for webmail templates and shared hosting environments to detect unauthorized script injections.
* **Browser Security:** Restrict the installation of browser extensions to a pre-approved allowlist and monitor for unauthorized WebSockets to unknown C2 IPs.
* **Enhanced Authentication:** Deploy FIDO2-based hardware security keys to mitigate the impact of stolen session cookies and credentials.
* **Network Monitoring:** Monitor for DNS tunneling and unusual traffic patterns directed toward public cloud services like Google Docs that may be hosting obfuscated payloads.