Jewelbug APT Group Linked to Cyber Espionage and Crypto Fraud Operations
Security researchers from Broadcom’s Threat Hunter Team have uncovered that the threat group known as Jewelbug, associated with Chinese-sponsored cyber espionage, is also involved in hack-for-hire activities and profitable cryptocurrency fraud. In a report released on August 13, the team, which includes experts from Symantec and Carbon Black, provided insights into this advanced persistent threat (APT) group, also referred to as Ink Dragon, Earth Alux, REF770, and CL-STA-0049.
The investigation revealed that Jewelbug employs the same infrastructure for espionage against governments and militaries in regions such as the Middle East, Southeast Asia, and South Asia, while simultaneously running operations targeting Chinese-speaking cryptocurrency users through deceptive exchange-download portals. The report emphasized that these operations are not separate but are managed by the same small team using a unified control panel.
One of the identified operators, referred to as ‘ople500’ within the group’s control panel, has been linked to a persona known as ‘paopaodada’ or ‘bubble boss.’ This individual has been promoted on Telegram as a contact for a service that rents website rankings. Broadcom has associated this persona with a company registered in Changsha, Hunan province, which is believed to provide access and infrastructure for the espionage activities.
Jewelbug's cyber espionage efforts have been documented by various threat intelligence organizations, including Trend Micro and Palo Alto Networks. The group typically gains access through vulnerabilities in IIS and SharePoint servers, deploying web shells and sophisticated backdoors known as VARGEIT, Squidoor, or FinalDraft. These malware tools support various covert command-and-control (C2) methods, including Microsoft Graph/Outlook APIs, DNS tunneling, and ICMP tunneling.
Broadcom's investigation highlighted that Jewelbug has targeted numerous government organizations, with over 90 police and government email addresses compromised in South Asia. The researchers also discovered a victim database that recorded over one million implant check-ins and more than 580,000 stolen browser cookies within a three-month period. In one significant operation, the group managed to plant a script that compromised over 15 government webmail tenants in a Middle Eastern country simultaneously.
In addition to espionage, some of Jewelbug's infrastructure has been utilized for cryptocurrency fraud, specifically targeting Chinese-speaking users through fake exchange-download websites. The report noted that decoy documents themed around Taiwanese government organizations indicated the group's interest in Taiwan as well.
The central management console for both the espionage and cryptocurrency fraud operations is XG-Web, a browser-based C2 platform. This infrastructure administers victims from both campaigns, with all implants, stolen data, and operator activities feeding into a shared backend database. One of the key tools linked to this infrastructure is Antino, a Windows backdoor that communicates with operators via the Microsoft Graph API, allowing C2 traffic to blend with legitimate Microsoft cloud services.
Antino has been deployed across multiple Jewelbug campaigns, often through fake software installers and themed lures. The group also operates a malicious browser extension called ‘PDF Viewer,’ disguised as a Microsoft Edge component, which provides extensive access to victims' browsers, enabling the theft of cookies, credentials, and browsing data. Additionally, Jewelbug employs a Linux and router implant known as ClientKing, which supports multiple C2 methods and offers remote shell access.
The researchers noted that the infrastructure for ClientKing overlaps with the broader XG-Web ecosystem, further linking the espionage and fraud operations. Moreover, the group has exploited Google Docs for payload delivery and C2, creating public documents containing obfuscated payloads that implants retrieve and execute, disguising malicious activities as legitimate traffic to evade detection.
