A China-based threat actor identified as Jewelbug has been conducting large-scale espionage operations against government and military targets across the Middle East, Southeast Asia, and South Asia while simultaneously running a for-profit cryptocurrency fraud scheme, according to research published by Symantec's Threat Hunter Team. The group operates both missions from a single command-and-control infrastructure called XG-Web, a browser-based remote access platform built on React and Node.js. Symantec researchers traced at least one operator to a registered company in Hunan Province, China, and identified individuals through government-issued identity documents recovered during the investigation.
Jewelbug's primary attack vector involves a malicious browser extension disguised as "PDF Viewer" that runs on Chrome and Firefox. The extension requests extensive permissions including cookie access, script injection capabilities, debugger access, and web request interception across all websites. Once installed, it functions as a complete remote bridge into the victim's browser, allowing operators to execute arbitrary JavaScript, harvest credentials through login form hooks, and exfiltrate cookies in near real-time. The extension communicates with a Windows helper component falsely registered as a Microsoft Edge component (com.microsoft.runedge), which executes system commands and breaks out of the browser sandbox to compromise the host machine.
The group deploys additional tools including the Antino backdoor, which uses Microsoft Graph API as its command-and-control channel to hide malicious traffic within legitimate Microsoft cloud services. Antino is distributed through fake Adobe installers and HTML Application downloaders themed around geopolitical events, including lures impersonating invitations to events hosted by Washington-based think tanks. Jewelbug also operates ClientKing, a Rust-based implant with 37 different builds targeting Linux servers, ARM64 devices, and ASUS routers. This implant supports multiple command-and-control transports including a custom DNS tunnel, provides interactive shell access, and can load kernel modules directly from memory. Some ClientKing builds were configured to use the internal corporate proxy of a major U.S. aerospace and industrial manufacturer.
The scale of Jewelbug's operations is extensive, with the group's victim database containing over one million implant check-ins, more than 580,000 stolen browser cookies, several thousand captured credentials, and over 2,300 exfiltrated email bodies collected in less than three months. In one significant operation, the group compromised a shared web-hosting platform operated by a Middle Eastern state telecommunications provider, allowing them to inject a watering-hole script into more than 15 government webmail tenants simultaneously. Server logs recorded approximately 1.1 million geolocation events from roughly 4,300 distinct IP addresses, including connections from state telecom networks, military infrastructure, and government ministry systems. The group uses Google Docs as a command-and-control mechanism, creating public documents containing obfuscated payloads that implants fetch and execute, leveraging Google's infrastructure to evade reputation-based filtering.
Organizations should immediately audit installed browser extensions and remove any unauthorized PDF viewers or document readers, particularly those requesting excessive permissions. Network defenders should monitor for unusual Microsoft Graph API traffic patterns that could indicate Antino backdoor activity, review internal proxy configurations for unauthorized external use, and implement strict application whitelisting to prevent execution of unsigned or suspicious binaries. Security teams should also inspect web application servers for unauthorized script injections, particularly in shared hosting environments serving multiple tenants, and deploy network segmentation to limit lateral movement from compromised endpoints. Given Jewelbug's use of legitimate cloud services for command-and-control, organizations should implement SSL inspection and behavioral analysis to detect anomalous patterns within otherwise trusted traffic.
Source: https://symantec-enterprise-blogs.security.com/threat-intelligence/jewelbug-crypto-fraud-espionage