Jewelbug Hacker Group Conducts Dual Espionage and Cryptocurrency Fraud Operations The China-linked hacker group Jewelbug (also known as Earth Alux and REF7707) has been conducting a dual campaign of cyber espionage and large-scale cryptocurrency fraud, targeting governments, militaries, and critical sectors while simultaneously running a profit-driven hack-for-hire operation. In a recent attack, Jewelbug compromised webmail accounts across 15 government tenants in the Middle East by gaining write access to a shared webmail installation. The group injected a malicious script into the platform’s common template, which executed on login pages and mailbox views. The script established a WebSocket connection to a command-and-control (C2) server, exfiltrating webmail cookies and identifying high-value government targets. Victims were then tricked into installing the Antino backdoor via fake Adobe Flash update prompts, enabling further payload deployment. Jewelbug’s toolkit includes the XG-Web remote-access framework, used for managing campaigns and stolen data, as well as a malicious browser extension called PDF Viewer, which steals cookies, credentials, and intercepts browser traffic. Symantec’s investigation revealed the group’s C2 infrastructure, exposing over 1 million implant check-ins, 580,000 stolen browser cookies, and 2,300 exfiltrated email bodies. The espionage operations primarily targeted government and military entities in the Middle East, Southeast Asia, and South Asia, with nearly 1.1 million geolocation events recorded from 4,300 distinct IP addresses. Parallel to its espionage activities, Jewelbug operates an industrial-scale cryptocurrency fraud scheme, using AI-generated articles to drive traffic to fake crypto exchange sites impersonating OKX and Binance. The group employs click-fraud bots to manipulate search rankings and deploys a 44-server content-management fleet across hundreds of lookalike domains. Additional fraud lures include sports betting, pirated livestreams, and private detective scams, with Symantec attributing the financially motivated operations to a Chinese company advertising SEO services. Jewelbug also utilizes ClientKing, a Rust-based implant targeting Linux servers, ARM64 devices, and ASUS routers, capable of command execution, SOCKS proxying, and DNS tunneling. To evade detection, the group leverages public Google Docs to host obfuscated payloads, blending malicious traffic with legitimate Google services. Symantec has released indicators of compromise and a detailed technical report on the group’s infrastructure and tactics.