Loading story…
Chinese state-linked hackers, identified as the Jewelbug group, infiltrated a major Russian IT service provider in a sophisticated espionage campaign that spanned from January to May 2025. The breach was uncovered by Symantec researchers, who reported that the attackers gained access to the company’s software build and code repository systems, raising concerns about a potential software supply chain attack targeting the provider’s downstream clients. The targeted company, though unnamed, is described as a significant provider with government-related clients, amplifying the potential impact of the intrusion. Jewelbug, also tracked as Earth Alux, CL-STA-0049, and REF7707 by various security vendors, has a history of targeting government and corporate networks across South America, South and Southeast Asia, and Taiwan, but this marks a rare incursion into Russian infrastructure. The attackers conducted extensive reconnaissance, stole credentials, and maintained persistent access within the network, demonstrating advanced operational capabilities. Notably, the group used Yandex Cloud, a legitimate Russian cloud platform, to exfiltrate data, a tactic likely chosen to evade detection by blending malicious activity with normal network traffic. The use of Yandex Cloud is particularly effective in Russia, as it is a trusted domestic service and unlikely to be blocked or scrutinized by local enterprises. Technical analysis revealed that the attackers leveraged a renamed version of Microsoft Console Debugger (cdb.exe) to run shellcode, bypass application allowlisting, and disable security solutions, further highlighting the sophistication of the operation. The campaign is assessed to be part of a broader espionage effort, with no evidence of financial motivation. Researchers also observed the deployment of advanced malware, including FINALDRAFT (aka Squidoor), capable of infecting both Windows and Linux systems, and noted the possible development of new backdoors during related intrusions. The breach underscores that Russia is not immune to Chinese cyber espionage, despite close diplomatic and economic ties between the two countries. The incident has raised concerns about the security of Russian government and corporate networks, particularly those relying on IT service providers for software distribution and network management. The potential for a supply chain attack means that dozens of Russian companies could have been exposed to further compromise. The Jewelbug group’s operations reflect a growing trend of state-sponsored actors targeting IT service providers to maximize access and impact. The incident also highlights the importance of monitoring legitimate cloud services for signs of abuse in cyber operations. Security experts recommend heightened vigilance and improved monitoring of software build environments and cloud service usage to detect and mitigate similar threats. The breach serves as a reminder that geopolitical alliances do not guarantee immunity from cyber espionage activities. Ongoing analysis is expected to reveal further details about the attackers’ methods and the full scope of the compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On publication of the research, Symantec's Threat Hunter Team linked the five-month compromise of the Russian IT services provider to the China-linked group Jewelbug, also tracked as CL-STA-0049, Earth Alux, and REF7707. The disclosure also highlighted related Jewelbug activity against targets in South America, South Asia, and Taiwan, including use of a Microsoft Graph API and OneDrive-based backdoor.
During analysis of the intrusion, Symantec determined the attackers' access to code repositories and software build systems could have enabled a software supply-chain attack affecting the provider's Russian customers. The finding marked a rare publicly reported case of suspected Chinese cyber-espionage targeting Russian infrastructure.
Over roughly five months in 2025, the attackers used stealthy tradecraft such as renamed Microsoft debugging tools, credential dumping, scheduled-task persistence, and event log clearing while operating inside the Russian provider's network. They also used cloud services including Yandex Cloud for exfiltration or command-and-control to blend with normal traffic.
A China-linked threat actor later identified as Jewelbug began a covert intrusion against a Russian IT services provider in early 2025. The attackers established access to internal systems including code repositories, build servers, and other sensitive infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcesecurityonline.info
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcetherecord.media
Open sourcethehackernews.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Jewelbug**—also tracked as **Earth Alux**, `REF7707`, and `CL-STA-0049`—has been identified as a China-based hackers-for-hire group running state-aligned espionage campaigns alongside a large-scale cryptocurrency fraud operation from the same infrastructure. Researchers said the group targeted government ministries, militaries, police, and government email accounts across the Middle East, Southeast Asia, and South Asia, including a campaign that compromised a shared government webmail platform and turned it into a watering hole affecting more than 15 government tenants. The operation relied on the browser-focused **XG-Web** remote-access and information-stealing platform, the **Antino** Windows backdoor, a malicious **"PDF Viewer"** browser extension, and the **ClientKing** Linux/router implant. Investigators reported that the victim database logged more than **1 million implant check-ins**, over **580,000 stolen browser cookies**, thousands of credentials, and thousands of exfiltrated email bodies in under three months. The same operators also ran SEO-poisoning and fake exchange-download campaigns impersonating **OKX** and **Binance** to target Chinese-speaking cryptocurrency users, and the commercial side of the activity was linked to a registered company in **Hunan, China**, suggesting the fraud operation may have supplied access, delivery, or support for the espionage campaigns.
Aug 17, 2026
Australia’s ACSC and CISA warned that Chinese state-sponsored actors compromised networks worldwide as part of a broad espionage operation that targeted IT service providers and then leveraged that access to reach downstream customer environments. U.S. government reporting tied the activity to Chinese cyber actors associated with the Ministry of State Security, describing a long-running campaign that stole intellectual property and sensitive data from organizations across at least 12 countries and sectors including information technology, energy, healthcare, communications, and critical manufacturing. The intrusions relied on stolen administrative credentials, abuse of digital certificates, and post-compromise tooling including **PowerShell**, **PowerSploit**, **REDLEAVES**, and **PLUGX** to maintain persistence and move laterally. Authorities said the malware used techniques such as **DLL side-loading**, in-memory execution, and **RC4**-encrypted command-and-control over port `443`, including spoofed domains masquerading as Windows update infrastructure, and urged defenders to strengthen privileged account protections, network segmentation, logging, and monitoring for suspicious administrative share activity and protocol mismatches.
Jun 29, 2026
Security researchers reported multiple China-linked cyber-espionage operations aimed at Russian-speaking targets, including Russian state-owned defense research institutes within **Rostec**, a related research entity in Belarus, and systems associated with Russian officials. The campaigns used spear-phishing lures tied to **U.S. sanctions**, the **Ukraine war**, biological pathogen themes, and Belarus border tensions to entice victims into opening disguised executables or malicious documents delivered through fake websites and staged downloads. The intrusions deployed distinct malware families and loaders, including the newly identified **SPINNER** backdoor and updated **PlugX** tooling. Researchers said the activity relied on **DLL sideloading/search-order hijacking**, multi-stage loaders, in-memory decryption, persistence mechanisms, and anti-analysis techniques such as dynamic API resolution and control-flow obfuscation. Check Point assessed the **Twisted Panda** operation with high confidence as Chinese state-backed espionage with tradecraft overlaps to **Mustang Panda** and **APT10**, while Secureworks linked the PlugX activity to **BRONZE PRESIDENT**, indicating a broader Chinese intelligence effort focused on Russian defense and government-related targets after the invasion of Ukraine.
Aug 15, 2026