Jewelbug Targets Government Webmail While Running Crypto-Fraud Operations
Summary
Symantec reports Jewelbug compromised shared webmail used by 15 government tenants, stealing cookies, credentials and email data while running espionage tooling and AI-generated crypto-fraud campaigns from linked infrastructure.
Key points
- Symantec says Jewelbug compromised a shared web-hosting platform and injected a script into webmail used by more than 15 government tenants.
- The script opened a WebSocket to the attackers’ C2, stole webmail cookies and checked email addresses for targeted government domains.
- Researchers say fake Adobe prompts delivered the Antino backdoor; the PDF Viewer browser extension could steal credentials and cookies, intercept traffic and inject JavaScript.
- Symantec reports the group’s database contained over 580,000 stolen browser cookies, several thousand captured credentials and more than 2,300 exfiltrated email bodies.
- The investigation linked the espionage and crypto-fraud activity to shared infrastructure; the fraud used AI-generated fake download pages, lookalike exchange sites and click-fraud bots.
- Jewelbug also used ClientKing, a Rust-based implant for Linux, ARM64 devices and ASUS routers, with command-execution, proxying and DNS-tunneling capabilities.
Article Details
- Attack Vectors
- Compromised a shared web-hosting platform and modified a shared government webmail template to inject JavaScript across multiple tenants.
- The injected script connected to a command-and-control server over WebSocket and exfiltrated webmail cookies.
- Used fake Adobe Flash prompts, fake installers, and malicious HTA files to deliver the Antino backdoor.
- Used the PDF Viewer browser extension to steal cookies and credentials, intercept traffic, inject JavaScript, and expose browser functions remotely.
- Hosted obfuscated payloads on public Google Docs for implants to retrieve and execute.
- Published AI-generated pages impersonating OKX and Binance and used click-fraud bots to manipulate search rankings.
- Used ClientKing implants supporting command execution, SOCKS proxying, DNS tunneling, and in-memory kernel module loading.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe webmail script exfiltrated cookies, and the operation also exfiltrated email data.T1059.007 · JavaScriptAn injected JavaScript payload ran on government webmail login pages and mailbox views.T1071.001 · Web ProtocolsThe injected script established a WebSocket connection to the attackers’ C2 server.T1071.004 · DNSClientKing supports DNS tunneling.T1090 · ProxyClientKing supports SOCKS proxying.T1105 · Ingress Tool TransferImplants retrieved obfuscated payloads hosted on public Google Docs.T1114.002 · Remote Email CollectionJewelbug collected email data from compromised government webmail, including exfiltrated email bodies.T1539 · Steal Web Session CookieThe webmail script and PDF Viewer extension stole browser session cookies.T1555.003 · Credentials from Web BrowsersThe PDF Viewer extension stole credentials stored or entered in browsers.
Threat Actors
Earth AluxThe article identifies Earth Alux as another name for Jewelbug, which Symantec linked to espionage and cryptocurrency fraud.JewelbugSymantec reported that Jewelbug conducted government and military espionage and cryptocurrency fraud; it linked both activities to the same infrastructure. The article describes the group as China-based.REF7707The article identifies REF7707 as another name for Jewelbug, which Symantec linked to espionage and cryptocurrency fraud.
Malware
Vendors
Products
Adobe FlashValuable targets would receive a fake Adobe Flash update prompt, which installs the main payload on Windows, the Antino backdoor, and browser tooling.Binance#JewelbugGoogle ChromeOne of the payloads is a malicious browser extension for Chrome and Firefox, named PDF Viewer, which steals cookies and credentials, intercepts traffic, injects JavaScript, and remotely exposes browser functions.Google DocsThe hackers used public Google Docs to host obfuscated payloads retrieved and executed by their implants, helping the malicious traffic blend in with legitimate Google services.Mozilla FirefoxOne of the payloads is a malicious browser extension for Chrome and Firefox, named PDF Viewer, which steals cookies and credentials, intercepts traffic, injects JavaScript, and remotely exposes browser functions.OKX#Jewelbug
Tools
Countries
Industries
Aviationagencies and organizations in critical sectors, including defense, telecommunications, education, and aviation, its cryptocurrency-related activity suggests that they may also operate as a hack-for-hire group thatDefensethe threat actor has targeted government agencies and organizations in critical sectors, including defense, telecommunications, education, and aviation, its cryptocurrency-related activity suggests that they mayEducationgovernment agencies and organizations in critical sectors, including defense, telecommunications, education, and aviation, its cryptocurrency-related activity suggests that they may also operate as aGovernmentThe group used compromised government webmail, fake software prompts, malicious browser tools, and AI-generated scam pages to steal cookies, credentials, and email data.MilitaryJewelbug targeted government and military organizations across multiple regions.Telecommunicationsactor has targeted government agencies and organizations in critical sectors, including defense, telecommunications, education, and aviation, its cryptocurrency-related activity suggests that they may also operate