ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Threat actor

REF7707

0 mentions in 7 days · 0 in 30 days · 1 total · first seen · last

Search everything

Timeline

China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud

China-linked Jewelbug runs government espionage and crypto fraud from a single XG-Web browser-based control framework.

Broadcom's Symantec and Carbon Black detail Jewelbug, a China-based hackers-for-hire group conducting espionage against governments and militaries in the Middle East, Southeast Asia, and South Asia, plus crypto fraud against Chinese-speaking victims. Operations center on XG-Web, a browser-centric remote-access and infostealing framework, with implants spanning browsers, Windows, Linux, and network devices. The group overlaps with CL-STA-0049, Ink Dragon, Earth Alux, and REF7707, and compromised a Middle Eastern government's webmail across 15 tenants.

The Hacker News · Aug 15, 2026Threat actor in the wild

Appears with

threat actor CL-STA-0049 1threat actor Earth Alux 1threat actor Ink Dragon 1threat actor Jewelbug 1malware Antino 1malware ClientKing 1organization Broadcom 1organization Check Point 1organization Elastic Security Labs 1organization Palo Alto Networks Unit 42 1organization Trend Micro 1product Antino 1product ClientKing 1product PDF Viewer 1product XG-Web 1vendor Broadcom 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.