Key findings
- Jewelbug is a China-based hackers-for-hire group that runs parallel operations: espionage against governments and militaries across the Middle East, Southeast Asia and South Asia, and a for-profit cryptocurrency fraud business.
- Both missions are administered from a single control panel, XG-Web, a browser-centric remote-access and information-stealing framework that turns a victim’s browser into a full remote-control channel and reaches from there into the host and the internal network behind it.
- At least one of the operators is tied to a registered Hunan company, and we have identified the sole legal representative by name from government-issued identity documents belonging to the operators.
- Jewelbug’s main implant is the Antino backdoor. It also operates a malicious Chrome and Firefox extension posing as an application called “PDF Viewer”, paired with a helper disguised as a Microsoft Edge component that gave operators a command shell on the host.
- In its largest operation, a single planted script placed a watering-hole on more than 15 government webmail tenants in a Middle Eastern country at once.
- Jewelbug’s victim database recorded more than one million implant check-ins and more than 580,000 stolen browser cookies in less than three months of active operations. One set of implants was configured to utilize the internal proxy of a major U.S. aerospace and industrial manufacturer.
Overview
A months-long investigation by the Symantec Threat Hunter Team has produced unprecedented visibility into the activities of Jewelbug (aka Earth Alux, REF7707, CL-STA-0049), a China-based APT group that has been breaking into government ministries across Asia and the Middle East while quietly running a cryptocurrency fraud business on the side. The two are not separate ventures that happen to share a name: our investigation revealed they are run by the same small team, on shared infrastructure, from one control panel.
Jewelbug’s commercial arm is tied to a known registered company in Hunan Province, China. The group has developed five generations of command-and-control (C&C) code and a family of implants spanning browsers, Windows endpoints, Linux servers and network devices, all of it feeding a single database of victims. That toolset serves two missions: espionage attacks against foreign governments and militaries, and for-profit crypto fraud aimed at Chinese-speaking victims.
Targeting
The clearest statement of intent is the group's own campaign list, because each entry is a campaign the operators created and named themselves. On the espionage side, campaigns targeted government organizations across the Middle East and Southeast Asia. Other lists targeted more than 90 police and government email addresses in South Asia.
The group's separate Linux and router implant enables it to extend its reach into network infrastructure, with a couple of builds configured to beacon through the internal corporate proxy of a major U.S. aerospace and industrial manufacturer.
A parallel, financially motivated operation targeted Chinese-speaking cryptocurrency users through fake exchange-download portals. Decoy documents styled after Taiwanese government bodies suggest its interest also extended to Taiwan. The common thread across espionage targets is government communications and the providers that host them, which would give an intelligence customer broad, durable access to official correspondence.
Tooling and tradecraft
At the core of the operation is XG-Web, a browser-centric remote-access and information-stealing platform built as a React panel over a Node.js backend, and a MySQL database that doubles as the rendezvous point for victim implants. The developers describe XG-Web in their own documentation as a “penetration-testing platform,” a description its actual use contradicts. Internal terms for its functions include “browser hijacking,” “data theft” and “man-in-the-middle attack.”
A scheduled job checked the group's own C&C domains against VirusTotal every 12 hours so operators could rotate away from anything that had been flagged.
The “PDF Viewer” extension and its native shell
The group's primary implant was a malicious browser extension named “PDF Viewer”, which was built to run in both Chrome and Firefox. Masquerading as a document reader, it requested effectively every dangerous permission the browser exposes: cookies, scripting, debugger access, web request interception, download monitoring, and native messaging across all sites. A background service worker acted as a full remote bridge into the browser API. An operator could invoke any Chrome or Firefox function on the victim's behalf by name, inject and execute arbitrary JavaScript on any page, and interact with the browser as if sitting at the keyboard.
The extension harvested credentials by hooking login forms, exfiltrated the victim's full cookie jar, subscribed to live cookie-change events to steal new session tokens in near real time, and captured history, bookmarks, screenshots, the clipboard and intercepted traffic. A clipboard module capable of silently swapping a copied cryptocurrency address for the attacker’s own is built into the codebase. The module has been active on victims, but no address-replacement rules were deployed, meaning the swapping feature was not used during the observed campaign period. To escape the browser sandbox, the extension talked to a Windows helper registered as a native-messaging host under the misleading name com.microsoft.runedge, which ran operator commands through the Windows command interpreter and returned the output to the panel.
The Antino backdoor
Antino is the group's Windows backdoor and the payload behind a wave of malicious HTML Application (HTA) downloaders, themed on current geopolitical events, that prompted this investigation. It is also delivered as a fake Adobe Flash or Adobe installer (file names such as flashcenter_pp_ax_install_en.exe and Adobeinstall.exe) downloaded from group-controlled domains.
Once running, Antino uses the Microsoft Graph API as its C&C channel, hiding its traffic inside legitimate Microsoft cloud services. It is a shared tool used across the group's campaigns, recovered from infected hosts in the Middle East and submitted to public scanners from victims in the Middle East and South Asia, and it is the on-host backdoor that the fake-update lure seen in Figure 2 ultimately installs on the endpoint. The lure in Figure 2 is attempting to impersonate an invitation to an event run by the Center for Strategic and International Studies, a Washington-based think tank working across the areas of defense and security, geopolitics and foreign policy, economic security and technology, and global development. This lure serves to illustrate the types of areas and sort of people Jewelbug may be hoping to compromise.
ClientKing, a Linux and router implant
Alongside the browser framework, the group operates 37 builds of a Rust implant the developers call ClientKing, which reached servers and network devices rather than browsers. It supported five C&C transports, including a custom domain-name-system (DNS) tunnel, and offered a full interactive shell, SOCKS pivoting and the ability to load kernel modules directly from memory. A companion toolkit added a kernel-module rootkit and a malicious authentication module hooked into the secure shell su and sudo to steal credentials. Builds spanned x86-64 servers, ARM64 devices and ASUS consumer routers. The most recent were stamped with the internal corporate proxy of a major U.S. aerospace and industrial manufacturer. ClientKing's C&C server was also hosted on the same network range as the XG-Web server.
Command-and-control through Google Docs
For delivery, the framework served a freshly obfuscated payload on every request. This was XOR encoded with a random key so no two downloads were identical, and the group disguised its C&C hostnames as typosquats of common resources such as Google Fonts. When an operator activated a campaign, the backend created a public Google Document, wrote an obfuscated payload into the body, and had implants fetch the documents and execute the payloads, which resolve to Google-owned infrastructure unlikely to be blocked by reputation filtering. Thirteen such documents were live and mapped to active campaigns.
Targeting on a large scale
The scale of the operation is vast. Jewelbug’s victim database holds more than one million implant check-in rows, more than 580,000 stolen browser cookies, several thousand captured credentials, and more than 2,300 exfiltrated email bodies. Request logs showed operators using a browser foothold to reach internal infrastructure, including authenticated traffic to a virtualization-management cluster inside a Middle Eastern government network. Runtime server logs recorded roughly 1.1 million geolocation events against approximately 4,300 distinct source IP addresses: approximately 87,200 connections from a Southeast Asian country (targeting state telecom and military networks), approximately 53,100 from a Middle Eastern country (across the national carrier’s ranges, including Starlink-connected addresses in the capital), and approximately 15,000 from a second Southeast Asian country (including government ministry infrastructure).
A parallel crypto-fraud business
The financial side of the operation is run as a registered Chinese company advertising a commercial “search-ranking rental” service on Telegram. The infrastructure was a search-engine-optimization (SEO) poisoning pipeline: an artificial-intelligence article generator that produced thousands of fake exchange-download pages, a fleet of more than 40 content-management servers, and click-fraud bots that drove search engines to rank those pages. The operators registered hundreds of look-alike domains impersonating the OKX and Binance exchanges and cloaked the pages so that crawlers saw phishing content while ordinary visitors were redirected.
Operator tradecraft
The operators work from inside China. Their virtual private network (VPN) routing profile is configured to bypass mainland-Chinese destinations while tunnelling everything else, the behavior of a user circumventing domestic filtering rather than concealing a foreign origin, and their working pattern is concentrated in the afternoons and late evenings of the UTC+8 time zone. Operational discipline is uneven: the group repeatedly tests its own stealer against its own browsers, runs the panel front end in development mode on a live production server, and reuses a single credential set across the panel and its commercial server fleet.
Attack chain example: watering-hole compromise of a Middle Eastern government webmail system
Jewelbug's largest espionage operation was a wide-ranging compromise of a Middle Eastern government. The operation is representative of how its campaigns proceeded.
Rather than breach each ministry separately, Jewelbug compromised the shared web-hosting platform run by the state telecommunications provider and national network-services agency, obtaining write access to the common webmail installation, and added a single script tag. Every government tenant on that platform had a watering-hole planted on it at once. A single campaign spanned more than 15 government webmail tenants, with the hook firing on the login page and every mailbox view, indicating it sat in the shared template rather than being delivered per user. The group also hooked the hosting provider's own administrators to harvest the credentials that granted that write access. The injected tag was disguised as an ordinary site asset:
<script src=“hxxps://fonts.chrorne[.]com/dist/js/12.qgfvjzvs.chunk.js”></script>
When a ministry staff member logged in, the script opened a WebSocket to the C&C, completed the cryptographic handshake and reported in. A cookie module exfiltrated the page's cookies, and a labelling module read the username from the webmail interface and tagged the new victim with their government email address. The operators then pushed a “flash” lure module, which confirmed the address ended in one of nine targeted government domains, that the account was not already compromised, and that the host was running Windows, before overlaying a fake Adobe Flash update prompt. When the victim clicked to update, the browser downloaded the second-stage executable from a group-controlled domain:
hxxps://microsoft-flash[.]com/download/Adobeinstall.exe
The downloaded executable was the group's Antino backdoor, a fake Adobe Flash or Adobe installer that beacons to the Microsoft Graph API for C&C. It also sideloaded the “PDF Viewer” extension into the victim's browser profile, dropped the native-messaging helper, and wrote the registry value that enabled it:
HKCU\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.microsoft.runedge
On the next launch, the extension connected to the C&C with the full browser API bridge available, giving operators unrestricted access to the browser and, through native messaging, the host. For at least one victim, it captured authenticated traffic to an internal virtualization-management interface, showing operators were actively reaching internal infrastructure:
hxxps://192.168.x.x:8006/api2/json/cluster/resources
Attribution
On the panel, the operators worked under the usernames “admin” and “admin_s”, the latter chose the display nickname “ople500”, and the exploit-module library was signed “Xg Team.” We assess with high confidence that the cryptocurrency fraud and SEO arm of the operation is run by a named individual, the sole legal representative of a Changsha company that openly describes itself as an SEO business. The attribution rests on government-issued identity documents, a company business license, and a signed and stamped authorization letter belonging to the operators.
