Jewelbug Spy Ring Hit 15 Ministries in One Strike, Ran Crypto Fraud From Same Panel

A China-linked mercenary hacking group has been simultaneously running government espionage operations across the Middle East, South Asia, and Southeast Asia and defrauding Chinese-speaking cryptocurrency users — from the exact same dashboard, on the same servers, administered by the same small team. The group, designated Jewelbug by Broadcom's Symantec Threat Hunter Team and also tracked as Earth Alux, REF7707, and CL-STA-0049 by competing research labs, has been active since at least the second quarter of 2023 — but the full scope of what it built became clear only through a months-long investigation whose findings Symantec published August 13, 2026.

The most concrete finding from that investigation is not that Jewelbug is Chinese-linked — that was suspected — but that it figured out how to compromise an entire national government's email system with a single move. By breaching the shared web-hosting platform run by one Middle Eastern country's state-owned telecommunications provider, the group planted a malicious script that deployed across more than 15 government webmail tenants at once. Every ministry, intelligence body, and security service sharing that platform became a collection point the moment any employee logged in to check their email, according to Symantec's reporting and BleepingComputer's coverage.