Chinese state-sponsored threat actor Jewelbug infiltrated a Russian IT provider’s network in early 2025, remaining undetected for five months. The attackers exploited a renamed Microsoft Console Debugger (CDB, disguised as 7zup.exe) to bypass defenses, dump credentials, elevate privileges via scheduled tasks, and clear Windows Event Logs to evade detection. The group targeted code repositories and software build systems, likely to facilitate supply chain attacks against the provider’s customers. Data exfiltration was conducted via Yandex Cloud, a Russian cloud service, to avoid suspicion. The breach involved unauthorized access to proprietary software and sensitive internal systems, posing risks of intellectual property theft, operational disruption, and potential downstream attacks on clients relying on the provider’s services. The incident underscores geopolitical tensions, as China-based actors targeted Russia despite perceived cyber alliances. Symantec highlighted the attack as part of Jewelbug’s broader campaign across South America, South Asia, Taiwan, and Russia, signaling escalating cyber espionage risks.