In tandem, the threat actor is said to have undertaken a financially motivated operation targeted at Chinese-speaking cryptocurrency users using fake exchange-download portals. The presence of decoy documents impersonating Taiwanese government entities suggests that the targeting also likely extends to Taiwan.
Central to the operations is a browser-centric remote-access and information-stealing platform called XG-Web. Built as a React panel over a Node.js backend and a MySQL database, the tool is described by the developers as a penetration-testing platform that makes use of a scheduled job to check the group's own C&C infrastructure against VirusTotal every 12 hours for swift rotation.
XG-Web also utilizes public Google Docs to host obfuscated payloads that are retrieved and executed by their implants. The payloads are XOR encoded with a random key to ensure that no two payloads are identical. The C&C hostnames are disguised to mimic common resources such as Google Fonts.
The primary implant of choice is a malicious browser extension named "PDF Viewer" that can run on both Google Chrome and Mozilla Firefox. Once installed, it requests a wide array of dangerous permissions to access cookies, the debugger, and native messaging, run scripts, intercept web requests, and monitor downloads across all sites.
The extension grants the ability to run arbitrary JavaScript on any web page, remotely interact with the web browser, and harvest credentials by hooking login forms, cookies, browsing history, bookmarks, screenshots, clipboard, and web traffic.
The clipboard module also functions like a clipper, swapping any copied cryptocurrency wallet address with an attacker's to reroute transactions. That said, no address-replacement rules have been triggered, indicating the clipper functionality was not put to use during the campaign period.
"To escape the browser sandbox, the extension talked to a Windows helper registered as a native-messaging host under the misleading name com.microsoft.runedge, which ran operator commands through the Windows command interpreter and returned the output to the panel," Symantec and Carbon Black said.
Some of the other tools in Jewelbug's arsenal are as follows -
- Antino, a Windows backdoor that's delivered via malicious HTML Application (HTA) downloaders centered around current geopolitical events, as well as bogus Adobe Flash or Adobe installer from threat actor-controlled domains. Upon execution, the malware uses the Microsoft Graph API for C&C to evade detection and blend in with normal traffic.
- ClientKing, a Rust implant that targets Linux servers and routers, and uses five C&C channels, including a DNS tunnel, to facilitate interactive shell, SOCKS pivoting, and the ability to load kernel modules directly from memory. A parallel toolkit features a kernel-module rootkit and a malicious authentication module hooked into the secure shell su and sudo to steal credentials.
In what has been described as the "largest espionage operation" undertaken by the threat actor, a web hosting provider was compromised to inject JavaScript code into a common webmail installation used by multiple ministries associated with a Middle Eastern government.
The watering hole campaign spanned 15 government webmail tenants, with the malicious code activating on the login page and every mailbox view to exfiltrate cookies over a WebSocket connection and serve a next-stage payload that checks if the victim email address is among the targeted government domains, the account has not already been compromised, and that the system is running Windows before displaying a fake Adobe Flash update prompt.
Victims who ended up clicking on the update receive Antino as the second-stage executable from a domain managed by the threat actor ("microsoft-flash[.]com"). The downloaded binary also sideloads the "PDF Viewer" extension into the user's browser profile and makes Registry modifications to ensure that the add-on automatically launches on the next launch of the browser.
The scale of the espionage campaign is believed to be vast, having collected more than one million implant check-in rows, over 580,000 stolen browser cookies, several thousand captured credentials, and no less than 2,300 exfiltrated email bodies. Runtime server logs have recorded roughly 1.1 million geolocation events against about 4,300 distinct source IP addresses.
These include -
- ~87,200 connections from a Southeast Asian country (targeting state telecom and military networks)
- ~53,100 from a Middle Eastern country (across the national carrier’s ranges, including Starlink-connected addresses in the capital)
- ~15,000 from a second Southeast Asian country (including government ministry infrastructure)
The financial arm of Jewelbug is operated as a registered Chinese company that advertises a commercial search engine optimization (SEO) service on Telegram. However, it is assessed to be a front for an SEO poisoning scheme that involves a combination of artificial intelligence (AI)-generated fake pages impersonating OKX and Binance, more than 40 content management servers, and click fraud bots that drive search engines to rank those pages.
"What makes Jewelbug notable is the combination of two missions in one set of hands," Symantec and Carbon Black said. "Foreign government and foreign military espionage was run from the same infrastructure, by the same team, as a commodity cryptocurrency fraud business."
"That pairing is the signature of a hack-for-hire entity that is running for-profit crime on the side. The exposure also shows the difference between targeting and compromise."
