China-based hackers-for-hire group staging espionage attacks alongside a cryptocurrency fraud business

Jewelbug is a China-based threat actor conducting dual operations: espionage campaigns targeting foreign governments and militaries, alongside a for-profit cryptocurrency fraud business administered from the same control panel. Operating as a small development team with role-based access controls and documented roadmaps, the group recorded over one million implant check-ins, 580,000+ stolen browser cookies, and 2,300+ exfiltrated emails between February and May 2026. Espionage attacks targeted government entities in the Middle East, Southeast Asia, and South Asia with confirmed intrusions. The group deploys the Antino backdoor, a malicious Chrome/Firefox extension called 'PDF Viewer,' and a Linux implant named ClientKing targeting servers and routers. The financially motivated arm operates as a registered Hunan company running industrial-scale SEO poisoning funneling Chinese-speaking victims to fake cryptocurrency exchange sites.

• Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by SideMalware2026-08-13
• SMTP is the key: BPFDoor and AVERAT hitting the network edgeMalware2026-10-02
• Prediction Markets Emerge as a New Vertical for Traffer TeamsCampaign2026-10-29
• RATatouille: Today's Special: Impersonating Companies in Korea, Payments in CryptocurrencyMalware2026-10-28
• QuartzLine: A working PDF viewer with a backdoor insideMalware2026-10-16