Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side

Jewelbug, a China-based APT group also known as Earth Alux or REF7707, conducts parallel espionage and cryptocurrency fraud operations using shared infrastructure and a unified control panel called XG-Web. The group targets government ministries in the Middle East, Southeast Asia, and South Asia through browser-based attacks and watering-hole compromises, while simultaneously running a for-profit crypto fraud scheme targeting Chinese-speaking users. Their primary malware includes the Antino Windows backdoor and a malicious 'PDF Viewer' browser extension, both deployed via fake software installers and HTA downloaders. The group leverages compromised hosting providers to scale attacks, stealing over 580,000 browser cookies and more than one million implant check-ins in under three months.

AI-extracted · verify before operational use