Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side

Jewelbug is a China-based hackers-for-hire group conducting parallel operations: espionage campaigns targeting government ministries and militaries across the Middle East, Southeast Asia, and South Asia, alongside a cryptocurrency fraud business. Both missions operate from a single control panel called XG-Web, a browser-centric remote-access framework. The group's main implant is the Antino backdoor, complemented by a malicious browser extension disguised as 'PDF Viewer' and the ClientKing Linux/router implant. Their largest operation compromised over 15 government webmail tenants in a Middle Eastern country through a single watering-hole attack. The victim database recorded over one million implant check-ins and 580,000 stolen browser cookies within three months. Operators are linked to a registered Hunan Province company, with infrastructure supporting both espionage and commercial SEO poisoning operations targeting Chinese-speaking cryptocurrency users.

• Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the GlobeMalware2026-11-10
• CVE-2026-109518: APT package manager that affects Ubuntu and Debian operating systemsHighVulnerability2026-11-06
• DarkBlinders: Active Espionage CampaignCampaign2026-11-03
• VAPOR PANDA Uses AI-Driven ARTEX to Grow Global Espionage CampaignMalware2026-10-31
• Google Brotli · 2nd November · Threat Intelligence ReportExploitedBreach2026-11-02