Jewelbug Hackers Conduct Espionage and Crypto Fraud Against Governments

The Jewelbug hacker group has been identified as a significant threat, conducting espionage operations that target government agencies and military organizations while also engaging in cryptocurrency fraud. This dual approach suggests that the group may operate as a hack-for-hire entity, seeking financial gain through cybercrime.

In a recent operation, Jewelbug compromised webmail accounts belonging to 15 government tenants in a Middle Eastern country. Researchers from Symantec discovered that the group executed both espionage and cryptocurrency fraud from the same control panel, indicating a high level of coordination in their activities.

The China-based hacker group gained write access to a shared webmail installation used by multiple government ministries and agencies. By injecting a malicious script into the common template, they were able to execute the script on login pages and mailbox views across the targeted tenants. This script established a WebSocket connection to the attackers' command-and-control server, allowing them to exfiltrate webmail cookies and retrieve email addresses to identify potential targets.

Valuable targets were then presented with a fake Adobe Flash update prompt, which installed the Antino backdoor on Windows systems, along with browser tooling. In addition to Antino, Jewelbug utilized the XG-Web framework for managing campaigns and victim data.

Symantec's research revealed that Jewelbug's operations are extensive, with their victim database containing over one million implant check-in records, more than 580,000 stolen browser cookies, and thousands of captured credentials and exfiltrated email bodies. The group's espionage efforts have focused on government and military organizations across regions including the Middle East, Southeast Asia, and South Asia.

The researchers noted that runtime server logs recorded approximately 1.1 million geolocation events from around 4,300 distinct source IP addresses, highlighting the scale of their operations. The group has targeted state telecommunications and military networks, among other critical infrastructures.

Jewelbug's cryptocurrency fraud operations are equally sophisticated, employing AI-generated articles to drive traffic to fake crypto exchange sites and utilizing click-fraud bots to manipulate search rankings. Their automated attack pipeline scrapes keywords and generates thousands of fake download pages, which are then published across a network of servers impersonating legitimate exchanges like OKX and Binance.

Additionally, the group employs various lures, including sports betting scams and pirated livestream portals, to attract victims. Symantec researchers have attributed Jewelbug's financially motivated activities to a Chinese company that offers SEO services.

The hackers also utilize a Rust-based implant called ‘ClientKing,’ which targets Linux servers and supports various malicious functionalities. They have cleverly hosted obfuscated payloads on public Google Docs, allowing their malicious traffic to blend in with legitimate Google services.

Symantec has published indicators of compromise related to Jewelbug's activities, along with a detailed technical report outlining the group's tools, techniques, and infrastructure used in their attacks. This comprehensive analysis underscores the need for heightened awareness and preventive measures against such sophisticated cyber threats.