China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud
China-linked Jewelbug runs government espionage and crypto fraud from a single XG-Web browser-based control framework.
Broadcom's Symantec and Carbon Black detail Jewelbug, a China-based hackers-for-hire group conducting espionage against governments and militaries in the Middle East, Southeast Asia, and South Asia, plus crypto fraud against Chinese-speaking victims. Operations center on XG-Web, a browser-centric remote-access and infostealing framework, with implants spanning browsers, Windows, Linux, and network devices. The group overlaps with CL-STA-0049, Ink Dragon, Earth Alux, and REF7707, and compromised a Middle Eastern government's webmail across 15 tenants.
- XG-Web panel unifies espionage and crypto fraud operations
- Malicious 'PDF Viewer' browser extension steals credentials and hijacks clipboard
- Antino Windows backdoor uses Microsoft Graph API for C2
- ClientKing Rust implant targets Linux servers and routers
- Watering hole hit 15 government webmail tenants in Middle East
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1189 Drive-by CompromiseT1114.002 Email Collection: Remote Email CollectionT1115 Clipboard DataT1098 Account Manipulation
- Vendors
- SymantecCarbon BlackBroadcom
- Products
- XG-WebAntinoClientKingPDF Viewer
- Threat actors
- JewelbugCL-STA-0049Ink DragonEarth AluxREF7707
- Malware
- AntinoClientKing
- Countries
- China
From the original article
5 min read at thehackernews.com
The China-linked threat actor known as Jewelbug has been observed carrying out cyber espionage operations targeting governments and militaries, while simultaneously engaging in cryptocurrency fraud.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.