Threat actor

Jewelbug

0 mentions in 7 days · 0 in 30 days · 2 total · first seen Aug 14, 2026 · last Aug 15, 2026

Timeline2 articles

China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud

China-linked Jewelbug runs government espionage and crypto fraud from a single XG-Web browser-based control framework.

Broadcom's Symantec and Carbon Black detail Jewelbug, a China-based hackers-for-hire group conducting espionage against governments and militaries in the Middle East, Southeast Asia, and South Asia, plus crypto fraud against Chinese-speaking victims. Operations center on XG-Web, a browser-centric remote-access and infostealing framework, with implants spanning browsers, Windows, Linux, and network devices. The group overlaps with CL-STA-0049, Ink Dragon, Earth Alux, and REF7707, and compromised a Middle Eastern government's webmail across 15 tenants.

The Hacker NewsAug 15, 00:00 UTC · Aug 15, 2026Threat actor in the wild

Researchers Link 'Jewelbug' Chinese APT to Hack-for-Hire Operations

Broadcom researchers link the Chinese APT group 'Jewelbug' to a lucrative crypto-fraud hack-for-hire operation.

Threat intelligence researchers at Broadcom reported that the known Chinese APT group tracked as Jewelbug may be connected to a profitable crypto fraud scheme. The findings suggest the group blends traditional espionage tradecraft with financially motivated hack-for-hire work. Victimology and operational scale were not detailed in the initial disclosure.

Infosecurity MagazineAug 14, 07:30 UTC · Aug 14, 2026Threat actor

Appears with

organization Broadcom 2 vendor Broadcom 2 threat actor Ink Dragon 1 threat actor REF7707 1 malware Antino 1 malware ClientKing 1 organization Check Point 1 organization Elastic Security Labs 1 organization Palo Alto Networks Unit 42 1 organization Trend Micro 1 product Antino 1 product ClientKing 1 product PDF Viewer 1 product XG-Web 1 vendor Carbon Black 1 threat actor CL-STA-0049 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.