{"id":2400,"date":"2026-08-18T05:08:17","date_gmt":"2026-08-18T05:08:17","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2400"},"modified":"2026-08-18T05:08:17","modified_gmt":"2026-08-18T05:08:17","slug":"china-linked-jewelbug-uses-xg-web-for-government-espionage-and-crypto-fraud","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2400","title":{"rendered":"China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud"},"content":{"rendered":"
\n
<\/a><\/div>\n

The China-linked threat actor known as Jewelbug<\/strong> has been observed carrying out cyber espionage operations targeting governments and militaries, while simultaneously engaging in cryptocurrency fraud.<\/p>\n

\u00abBoth missions are administered from a single control panel, XG-Web<\/b>, a browser-centric remote-access and information-stealing framework that turns a victim’s browser into a full remote-control channel and reaches from there into the host and the internal network behind it,\u00bb Broadcom’s Symantec and Carbon Black Threat Hunter Team said<\/a>.<\/p>\n

Jewelbug is assessed to be a China-based hackers-for-hire group that runs parallel operations, including espionage against governments and militaries across the Middle East, Southeast Asia and South Asia, and a for-profit cryptocurrency fraud business.<\/p>\n

\u00abThe group has developed five generations of command-and-control (C&C) code and a family of implants spanning browsers, Windows endpoints, Linux servers and network devices, all of it feeding a single database of victims,\u00bb Broadcom added. \u00abThat toolset serves two missions: espionage attacks against foreign governments and militaries, and for-profit crypto fraud aimed at Chinese-speaking victims.\u00bb<\/p>\n

At least one of the operators is said to be tied to a registered company based in Hunan Province. JewelBug overlaps with threat clusters tracked as CL-STA-0049 (Palo Alto Networks Unit 42), Ink Dragon (Check Point), Earth Alux (Trend Micro), and REF7707 (Elastic Security Labs). In October 2025, the hacking group was attributed to a five-month-long intrusion aimed at a Russian IT service provider to deliver malware capable of interfering with the normal functioning of security tools.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Symantec said it unearthed a campaign list following a months-long investigation, with entries highlighting espionage campaigns aimed at government organizations across the Middle East and Southeast Asia, as well as more than 90 police and government email addresses in South Asia.<\/p>\n

<\/p>\n

\u00abThe group’s separate Linux and router implant enables it to extend its reach into network infrastructure, with a couple of builds configured to beacon through the internal corporate proxy of a major U.S. aerospace and industrial manufacturer,\u00bb it noted.<\/p>\n

In tandem, the threat actor is said to have undertaken a financially motivated operation targeted at Chinese-speaking cryptocurrency users using fake exchange-download portals. The presence of decoy documents impersonating Taiwanese government entities suggests that the targeting also likely extends to Taiwan.<\/p>\n

Central to the operations is a browser-centric remote-access and information-stealing platform called XG-Web. Built as a React panel over a Node.js backend and a MySQL database, the tool is described by the developers as a penetration-testing platform that makes use of a scheduled job to check the group’s own C&C infrastructure against VirusTotal every 12 hours for swift rotation.<\/p>\n

XG-Web also utilizes public Google Docs to host obfuscated payloads that are retrieved and executed by their implants. The payloads are XOR encoded with a random key to ensure that no two payloads are identical. The C&C hostnames are disguised to mimic common resources such as Google Fonts.<\/p>\n

\"\"<\/a><\/div>\n

The primary implant of choice is a malicious browser extension named \u00abPDF Viewer\u00bb that can run on both Google Chrome and Mozilla Firefox. Once installed, it requests a wide array of dangerous permissions to access cookies, the debugger, and native messaging, run scripts, intercept web requests, and monitor downloads across all sites.<\/p>\n

The extension grants the ability to run arbitrary JavaScript on any web page, remotely interact with the web browser, and harvest credentials by hooking login forms, cookies, browsing history, bookmarks, screenshots, clipboard, and web traffic.<\/p>\n

The clipboard module also functions like a clipper, swapping any copied cryptocurrency wallet address with an attacker’s to reroute transactions. That said, no address-replacement rules have been triggered, indicating the clipper functionality was not put to use during the campaign period.<\/p>\n

\u00abTo escape the browser sandbox, the extension talked to a Windows helper registered as a native-messaging host under the misleading name com.microsoft.runedge, which ran operator commands through the Windows command interpreter and returned the output to the panel,\u00bb Symantec and Carbon Black said.<\/p>\n

Some of the other tools in Jewelbug’s arsenal are as follows –<\/p>\n