Full Report
China-based hackers-for-hire group is breaking into government ministries across the Middle East and Asia from the same control panel it uses to run an industrial-scale cryptocurrency fraud business.
Analysis Summary
# Threat Actor: Jewelbug
## Attribution & Identity
* **Name:** Jewelbug
* **Aliases:** Earth Alux, REF7707, CL-STA-0049
* **Origin:** China-based "hackers-for-hire" group.
* **Known Associations:** Linked to a registered commercial company in Hunan Province, China. At least one operator has been identified by name via government-issued identity documents found during the investigation.
## Activity Summary
Jewelbug operates a dual-track model, running high-level cyber espionage alongside industrial-scale cryptocurrency fraud from shared infrastructure. Recent activity involves breaking into government ministries and military organizations across Asia and the Middle East. Notably, the group used a single script to compromise over 15 government webmail tenants simultaneously in a single Middle Eastern country. Their operations are managed via a centralized control panel called **XG-Web** (aka "Xiang Ge – Security Testing Platform").
## Tactics, Techniques & Procedures
* **Watering Hole Attacks:** Compromising government webmail tenants to infect visitors.
* **Malicious Browser Extensions:** Posing as "PDF Viewer" for Chrome and Firefox to hijack browser APIs and steal session cookies.
* **Native Messaging:** Using a helper component disguised as Microsoft Edge to gain a command shell on the host.
* **Proxy Bouncing:** Configuring implants to beacon through the internal proxies of legitimate targeted organizations (e.g., a major U.S. aerospace manufacturer).
* **Persistence:** Utilizing scheduled jobs to check C2 domains against VirusTotal every 12 hours to automate infrastructure rotation.
* **Credential Harvesting:** Hooking login pages via JavaScript injection to steal credentials and cookies.
* **MITRE ATT&CK Techniques (Inferred):**
* T1189 (Drive-by Compromise)
* T1176 (Browser Extensions)
* T1555 (Credentials from Password Stores)
* T1071.001 (Application Layer Protocol: Web Protocols)
* T1090 (Proxy)
## Targeting
* **Sectors:** Government Ministries, Military, Police, Aerospace, Industrial Manufacturing, and Cryptocurrency.
* **Geography:** Middle East, Southeast Asia, South Asia, Taiwan, and Russia.
* **Victims:**
* 15+ Government webmail tenants in the Middle East.
* 90+ Police and government email addresses in South Asia.
* A major U.S. aerospace and industrial manufacturer.
* Chinese-speaking cryptocurrency users.
## Tools & Infrastructure
* **Control Panel:** XG-Web (Node.js/React framework).
* **Primary Backdoor:** Antino.
* **Malware/Tools:**
* "PDF Viewer" (Malicious Chrome/Firefox extension).
* Linux and router-specific implants.
* **Infrastructure (Defanged):**
* **Domains:**
* fonts[.]tarotfree101[.]top
* fonts[.]chrorne[.]com
* robot[.]avbliud[.]com
* microsoft-flash[.]com
* www[.]f1ash[.]org[.]cn
* mailbycloud[.]com
* **IP Addresses:**
* 103[.]87[.]9[.]62
* 152[.]42[.]174[.]151
* 43[.]246[.]208[.]236
* 47[.]84[.]37[.]113
* **C2/Payload URLs:**
* hxxps://microsoft-flash[.]com/download/flashcenter_pp_ax_install_en.exe
* hxxp://d2nq35tel3ucuo[.]cloudfront[.]net/LtVGUSsyUTDA.log
## Implications
The "hackers-for-hire" model indicates that Chinese state-aligned espionage is being outsourced to private entities that supplement their income with criminal fraud. The use of a single control panel for both missions increases the risk of "collateral" infection—where a criminal target provides a bridge into a corporate or government network. Their ability to compromise multiple government mail servers simultaneously suggests a high level of operational efficiency and a focus on long-term intelligence collection.
## Mitigations
* **Browser Security:** Implement strict policies regarding browser extensions; utilize allow-lists to prevent the installation of unverified or side-loaded extensions like the "PDF Viewer" mentioned.
* **Monitoring:** Hunt for unauthorized "Native Messaging" hosts in browser profile directories.
* **Proxy Logs:** Audit internal proxy logs for unusual beaconing patterns, specifically looking for traffic originating from internal network assets to unknown external Cloudfront or AWS API Gateway endpoints.
* **Credential Hygiene:** Enforce Hardware Security Keys (FIDO2) to mitigate the impact of stolen session cookies and automated "man-in-the-middle" browser hijacking.