Jewelbug: Chinese APT Group Widens Reach to Russia

A Chinese APT group named Jewelbug has expanded its operations to target organizations in South America, South Asia, Taiwan, and Russia. The group's recent intrusion into a Russian IT service provider lasted for five months in 2025, potentially aiming for a supply chain attack. Jewelbug has deployed new backdoors, including one leveraging Microsoft Graph API and OneDrive for command and control. The group's tactics include using legitimate tools, DLL sideloading, and the bring-your-own-vulnerable-driver technique. Notably, Jewelbug's targeting of Russian organizations marks a shift in Chinese cyber operations, previously considered to be allied with Russia.

• SilkParasite: Tracking a China-Nexus APT Across Central AsiaMalware2026-08-20
• Melofee: a look back at a Linux implant and its new variantsMalware2026-09-10
• Inside The Gentlemen: Undisclosed TukTuk C2 Framework and EDR Neutralization ResearchMalware2026-09-02
• One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law EnforcementMalware2026-07-09
• Iranian State-Aligned Threat Actor Masquerading as Dubai Airports IT Department Delivering Trojanized Coding Challenges - Blinder Tunnel Campaign Targeting Iraqi Critical InfrastructureMalware2026-10-07