Jewelbug hackers ran government espionage and crypto fraud from single control panel, Symantec finds

A China-linked hackers-for-hire group known as jewelbug has been linked to a broad cyber campaign targeting government and military organizations while operating a parallel cryptocurrency fraud business.

The findings, published by Broadcom’s Symantec and Carbon Black Threat Hunter Team after a months-long investigation, show that both activities were managed through the same infrastructure and control panel.

“Both missions are administered from a single control panel, XG-Web,” — Symantec and Carbon Black Threat Hunter Team.

The group, which overlaps with threat clusters tracked by other cybersecurity firms under names including Earth Alux, REF7707 and CL-STA-0049, has developed five generations of command-and-control code. Its malware ecosystem covers browsers, Windows computers, Linux servers and network devices, with stolen information ultimately feeding a common victim database.

Investigators said campaign records pointed to government organizations across the Middle East and Southeast Asia, alongside more than 90 police and government email addresses in South Asia. At least one operator was also linked to a registered company in China’s Hunan Province.

XG-Web turns browsers into remote-control channels

At the center of the jewelbug operation is XG-Web, a browser-based remote-access and information-stealing platform built with a React interface, a Node.js backend and a MySQL database. Although its developers described it as a penetration-testing platform, researchers found capabilities associated with browser hijacking and data theft.

The platform can use public Google Docs to distribute obfuscated payloads. Those payloads are XOR-encoded with random keys, making individual downloads different, while command-and-control hostnames are designed to resemble legitimate resources such as Google Fonts. A scheduled process also checked the group’s infrastructure against VirusTotal every 12 hours, allowing operators to identify infrastructure that had been detected and rotate it.

The main browser implant is a malicious extension called “PDF Viewer,” designed to operate on Google Chrome and Mozilla Firefox. Once installed, it requests extensive permissions, including access to cookies, web requests, browser debugging functions, downloads and native messaging.

The extension can execute JavaScript on websites, interact with the browser remotely and collect credentials, cookies, browsing history, bookmarks, screenshots, clipboard data and web traffic.

Its clipboard component also contains functionality capable of replacing copied cryptocurrency wallet addresses with addresses controlled by attackers, although researchers found no evidence that this replacement feature was activated during the observed campaign.

“To escape the browser sandbox, the extension talked to a Windows helper registered as a native-messaging host under the misleading name com.microsoft.runedge,” — Symantec and Carbon Black Threat Hunter Team.

That helper allowed commands to be executed through the Windows command interpreter, extending the attackers’ control beyond the browser itself.

jewelbug campaign reaches government networks

The scale of the espionage activity is reflected in the group’s victim records. Researchers identified more than one million implant check-ins, over 580,000 stolen browser cookies, several thousand captured credentials and more than 2,300 exfiltrated email bodies.

Runtime logs also recorded about 1.1 million geolocation events involving roughly 4,300 distinct source IP addresses. Among the recorded connections were about 87,200 from a Southeast Asian country targeting state telecommunications and military networks, roughly 53,100 from a Middle Eastern country across national carrier ranges, and approximately 15,000 from another Southeast Asian country that included government ministry infrastructure.

The group’s Linux and router implants gave it an additional route into network infrastructure. Some builds were configured to communicate through the internal corporate proxy of a major U.S. aerospace and industrial manufacturer.

One of the most significant campaigns involved a compromise of a web-hosting provider serving a Middle Eastern government.

Attackers injected JavaScript into a shared webmail installation used by more than 15 government tenants. The malicious code operated on login pages and mailbox views, enabling cookie theft and allowing the attackers to identify users whose email addresses matched targeted government domains.

Victims who met the campaign’s criteria were shown a fake Adobe Flash update. Those who clicked were served the Antino backdoor, which could also install the malicious “PDF Viewer” extension and make registry changes so the extension launched with the browser.

Alongside Antino, researchers identified ClientKing, a Rust-based implant targeting Linux servers and routers. It supports multiple command-and-control channels, including DNS tunneling, and provides capabilities such as interactive shell access and SOCKS-based network pivoting. A related toolkit includes a kernel-module rootkit and a malicious authentication module designed to steal credentials.

jewelbug pairs espionage with crypto fraud

The financial side of the operation targeted Chinese-speaking cryptocurrency users through fake exchange-download portals. Researchers linked the activity to a registered Chinese company advertising search-engine-optimization services on Telegram.

Investigators said the business appeared to function as a front for an SEO-poisoning operation. The infrastructure included AI-generated fake pages impersonating major cryptocurrency exchanges, more than 40 content-management servers and click-fraud bots designed to push malicious pages higher in search results.

The operation reportedly created look-alike pages for OKX and Binance. Users searching for those platforms could be directed to fraudulent pages and encouraged to download a trojanized desktop application or the malicious “PDF Viewer” browser extension, potentially exposing credentials, cookies and other sensitive information.

The presence of decoy documents impersonating Taiwanese government entities also suggested that the campaign’s targeting may have extended beyond Chinese-speaking crypto users.

“What makes Jewelbug notable is the combination of two missions in one set of hands,” — Symantec and Carbon Black Threat Hunter Team.

The jewelbug investigation underscores how modern hack-for-hire operations can combine espionage with conventional cybercrime. In this case, the same infrastructure supported campaigns against government and military targets while also enabling a commercial-style cryptocurrency fraud operation.

“The exposure also shows the difference between targeting and compromise,” — Symantec and Carbon Black Threat Hunter Team.

The findings illustrate why organizations cannot treat browser extensions, webmail infrastructure or seemingly ordinary software downloads as isolated security concerns. The campaign shows how a foothold in a shared service can provide access to multiple government tenants, while the same broader infrastructure can be adapted for financially motivated attacks.

For defenders, the case also highlights the importance of monitoring browser extensions, native-messaging components, suspicious webmail scripts, unauthorized registry changes and unusual access to cookies or credentials. The campaign’s scale demonstrates that the consequences of a successful browser compromise can extend well beyond an individual endpoint.