Loading story…
Jewelbug—also tracked as Earth Alux, REF7707, and CL-STA-0049—has been identified as a China-based hackers-for-hire group running state-aligned espionage campaigns alongside a large-scale cryptocurrency fraud operation from the same infrastructure. Researchers said the group targeted government ministries, militaries, police, and government email accounts across the Middle East, Southeast Asia, and South Asia, including a campaign that compromised a shared government webmail platform and turned it into a watering hole affecting more than 15 government tenants.
The operation relied on the browser-focused XG-Web remote-access and information-stealing platform, the Antino Windows backdoor, a malicious "PDF Viewer" browser extension, and the ClientKing Linux/router implant. Investigators reported that the victim database logged more than 1 million implant check-ins, over 580,000 stolen browser cookies, thousands of credentials, and thousands of exfiltrated email bodies in under three months. The same operators also ran SEO-poisoning and fake exchange-download campaigns impersonating OKX and Binance to target Chinese-speaking cryptocurrency users, and the commercial side of the activity was linked to a registered company in Hunan, China, suggesting the fraud operation may have supplied access, delivery, or support for the espionage campaigns.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
On August 13, Broadcom’s Threat Hunter Team reported that Jewelbug’s shared espionage and crypto-fraud operations were run by the same small team, identifying an operator as “ople500” and linking that activity to the “paopaodada” persona. Broadcom further assessed with high confidence that a Changsha, Hunan SEO business and its legal representative supplied access, infrastructure, and delivery for the espionage operation.
In October 2025, Jewelbug was attributed to a five-month intrusion targeting a Russian IT service provider. The intrusion reportedly deployed malware capable of interfering with the normal functioning of security tools.
Check Point Research reported a sustained Ink Dragon espionage campaign, overlapping with Jewelbug and CL-STA-0049, that showed increased targeting of European government entities while continuing operations in Southeast Asia and South America. The report also described the actor’s use of compromised IIS servers as a ShadowPad-based relay network and noted mass scanning for the SharePoint ToolShell exploit chain during early exploitation waves in July 2025.
Palo Alto Networks Unit 42 reported that suspected China-linked cluster CL-STA-0049 had been active since at least March 2023, targeting government, defense, telecommunications, education, and aviation organizations in Southeast Asia and South America. The report detailed the Squidoor (FinalDraft) backdoor, IIS exploitation, ASPX web shells, and covert C2 methods including Outlook API, DNS tunneling, and ICMP tunneling.
Symantec reporting said Jewelbug also breached a major U.S. industrial manufacturer, expanding the known victimology beyond government, military, and telecom targets in Asia and the Middle East. The disclosure indicates the group's operations affected at least one significant U.S. private-sector victim as well.
In the group's largest espionage campaign, Jewelbug compromised a shared web-hosting and government webmail platform operated by a state telecommunications provider and national network-services agency in a Middle Eastern country. This let the attackers deploy one watering-hole script across more than 15 government webmail tenants simultaneously.
The sources state that Jewelbug operated both state-aligned espionage campaigns and a for-profit cryptocurrency fraud operation from the same control panel and backend infrastructure. The overlap linked government intrusions with fake exchange-download schemes targeting Chinese-speaking cryptocurrency users.
Reporting describes Jewelbug, a China-based hackers-for-hire group, conducting espionage intrusions against government ministries and related government targets across the Middle East, Southeast Asia, South Asia, and Asia more broadly. The activity included targeting militaries, police, and government email accounts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourceinfosecurity-magazine.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcesecurity.com
Open sourceresearch.checkpoint.com
Open sourcetrendmicro.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Chinese state-linked hackers, identified as the Jewelbug group, infiltrated a major Russian IT service provider in a sophisticated espionage campaign that spanned from January to May 2025. The breach was uncovered by Symantec researchers, who reported that the attackers gained access to the company’s software build and code repository systems, raising concerns about a potential software supply chain attack targeting the provider’s downstream clients. The targeted company, though unnamed, is described as a significant provider with government-related clients, amplifying the potential impact of the intrusion. Jewelbug, also tracked as Earth Alux, CL-STA-0049, and REF7707 by various security vendors, has a history of targeting government and corporate networks across South America, South and Southeast Asia, and Taiwan, but this marks a rare incursion into Russian infrastructure. The attackers conducted extensive reconnaissance, stole credentials, and maintained persistent access within the network, demonstrating advanced operational capabilities. Notably, the group used Yandex Cloud, a legitimate Russian cloud platform, to exfiltrate data, a tactic likely chosen to evade detection by blending malicious activity with normal network traffic. The use of Yandex Cloud is particularly effective in Russia, as it is a trusted domestic service and unlikely to be blocked or scrutinized by local enterprises. Technical analysis revealed that the attackers leveraged a renamed version of Microsoft Console Debugger (cdb.exe) to run shellcode, bypass application allowlisting, and disable security solutions, further highlighting the sophistication of the operation. The campaign is assessed to be part of a broader espionage effort, with no evidence of financial motivation. Researchers also observed the deployment of advanced malware, including FINALDRAFT (aka Squidoor), capable of infecting both Windows and Linux systems, and noted the possible development of new backdoors during related intrusions. The breach underscores that Russia is not immune to Chinese cyber espionage, despite close diplomatic and economic ties between the two countries. The incident has raised concerns about the security of Russian government and corporate networks, particularly those relying on IT service providers for software distribution and network management. The potential for a supply chain attack means that dozens of Russian companies could have been exposed to further compromise. The Jewelbug group’s operations reflect a growing trend of state-sponsored actors targeting IT service providers to maximize access and impact. The incident also highlights the importance of monitoring legitimate cloud services for signs of abuse in cyber operations. Security experts recommend heightened vigilance and improved monitoring of software build environments and cloud service usage to detect and mitigate similar threats. The breach serves as a reminder that geopolitical alliances do not guarantee immunity from cyber espionage activities. Ongoing analysis is expected to reveal further details about the attackers’ methods and the full scope of the compromise.
Jun 29, 2026
An exposed Alibaba Cloud staging server revealed a China-nexus espionage operation tracked as **JadeProx** targeting government, healthcare, and education organizations across Asia and Latin America. Group-IB said the infrastructure exposed command history, phishing kits, webshell paths, tunneling tools, and post-exploitation utilities tied to intrusions involving a Vietnamese public hospital, Malaysia's Ministry of Foreign Affairs, Hong Kong education infrastructure, and phishing activity aimed at Honduras, alongside lures themed around a Venezuelan municipal tax portal. The campaign used a previously undocumented Windows malware family called **TriBack Loader**, delivered through four DLL sideloading infection chains and designed to execute shellcode through unusual Windows callback mechanisms to reduce detection. Investigators said different TriBack builds deployed **AdaptixC2** beacons or the **Beagle** backdoor, while operators also ran vulnerability scanning and attempted exploitation of multiple high-severity flaws; a fake Claude-themed site, `claude-pro[.]com`, was also used to distribute a malicious MSI installer for persistence.
Jul 23, 2026
Securonix Threat Labs reported that the **OCX#HARVESTER** campaign used phishing emails carrying ZIP archives with disguised `.lnk` files to compromise victims, with activity observed primarily between late 2022 and early 2023. The operation appears tied to the **More_eggs/Golden Chickens** malware ecosystem and likely focused on organizations and individuals linked to the financial sector, particularly cryptocurrency-related entities. After execution, the infection chain launched obfuscated JavaScript loaders and abused multiple Windows living-off-the-land binaries, including `ie4uinit.exe`, `msxsl.exe`, `wmic.exe`, `regsvr32.exe`, `curl.exe`, and `typeperf.exe`, to stage payloads, establish persistence, and communicate with command-and-control infrastructure. Later stages deployed several **OCX#HARVESTER** binaries, including a screenshot-capture component, additional obfuscated implants, and what researchers assessed was likely a **Cobalt Strike** beacon. Operators also retrieved **SharpChrome** to steal Chrome cookies and credentials, expanding the campaign from initial access to credential theft and post-compromise surveillance. The use of `msxsl.exe`, a known LOLBin documented by the LOLBAS project, underscores the campaign's reliance on legitimate Microsoft-signed utilities to blend malicious activity into normal system operations, while shifting command-and-control infrastructure suggests the toolkit remains actively maintained and adapted to evade detection.
Aug 14, 2026