Loading malware…
Jewelbug is a China-linked advanced persistent threat group, also tracked as CL-STA-0049, Earth Alux, and REF7707. Reporting cited in the provided content attributes to Jewelbug a multi-month cyber-espionage intrusion against a Russian IT services provider in 2025, as well as activity targeting a South American government, a Taiwanese company, and a South Asian IT provider. In the Russian case, the group reportedly maintained access from January through May 2025 and reached build servers, code repositories, and other sensitive internal systems, creating potential for a software supply-chain compromise affecting the provider’s Russian customers.
Observed tradecraft includes use of a renamed Microsoft debugger, cdb.exe, as 7zup.exe to execute shellcode, spawn DLLs, or hijack processes; credential dumping, including references to LSASS and Mimikatz; scheduled-task persistence; and clearing Windows Event Logs. Additional tooling and techniques mentioned in the content include DLL sideloading, SMBExec for lateral movement, BITSAdmin and curl for exfiltration, AnyDesk and 7-zip deployment, Fast Reverse Proxy and Earthworm tunneling, and privilege-escalation tools such as PrintNotifyPotato and Sweet Potato. The group also reportedly used KillAV to disable security software and EchoDrv to abuse a vulnerability in the ECHOAC anti-cheat driver as a BYOVD technique.
The content states that Jewelbug used Yandex Cloud for data exfiltration in the Russian intrusion, including a malicious file named yandex2.exe, likely to blend with normal Russian enterprise traffic. It also describes a newer backdoor associated with Jewelbug that uses Microsoft Graph API and OneDrive for cloud-based command and control. Reported capabilities of this backdoor include collecting system information, creating hidden directories, enumerating and uploading file lists, and logging actions. In other intrusions, Jewelbug reportedly used DLL sideloading to deliver payloads including ShadowPad.
Based on the provided reporting, Jewelbug primarily conducts espionage-oriented operations and has targeted government and IT-sector organizations across Russia, South America, Taiwan, and South Asia. The content highlights the risk posed by its compromises of IT service providers because such access can enable downstream supply-chain attacks and broader espionage or disruption.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Jewelbug is a Chinese APT group known for stealthy cyber espionage operations, including supply chain attacks. It uses renamed legitimate tools (e.g., cdb.exe as 7zup.exe) for code execution, credential dumping, persistence, and exfiltration via cloud services. The group has targeted Russian IT providers and South American organizations, leveraging cloud-based C2 infrastructure for stealth.
Jewelbug is a China-linked advanced persistent threat (APT) group known for cyber espionage operations. It targets IT providers and government entities, leveraging custom backdoors, credential dumping, privilege escalation, and supply chain attack techniques. The group uses renamed legitimate tools for stealth, cloud services for exfiltration and C2, and is actively developing new malware capabilities.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.