Hackers breach govt webmail while running parallel crypto fraud

The Jewelbug hacker group has been carrying out espionage operations targeting governments and militaries while also engaging in cryptocurrency fraud.

Although the threat actor has targeted government agencies and organizations in critical sectors, including defense, telecommunications, education, and aviation, its cryptocurrency-related activity suggests that they may also operate as a hack-for-hire group that seeks to profit from cybercrime.

In a recent operation, Jewelbug (also known as Earth Alux and REF7707) compromised webmail accounts belonging to 15 government tenants as part of a campaign targeting a country in the Middle East.

Researchers at Symantec found that the espionage campaign and the cryptocurrency fraud were conducted from the same control panel.

The China-based hacker group gained write access to the shared webmail installation and inserted a malicious script into its common template. The script then ran on login pages and mailbox views across 15 tenants.

After execution, the script established a WebSocket connection to the attacker’s command-and-control (C2) server, exfiltrated webmail cookies, and retrieved the user’s email address to determine whether it belonged to a targeted government domain.

Valuable targets would receive a fake Adobe Flash update prompt, which installs the main payload on Windows, the Antino backdoor, and browser tooling.

Apart from Antino, the threat actor also uses the XG-Web remote-access and data-theft framework for managing campaigns and victim information.

According to Symantec, Jewelbug delivers Antino through malicious HTA files and fake Adobe Flash/Adobe installers, and then uses it to deploy additional payloads.

One of the payloads is a malicious browser extension for Chrome and Firefox, named PDF Viewer, which steals cookies and credentials, intercepts traffic, injects JavaScript, and remotely exposes browser functions.

Symantec traced Antino infections to Jewelbug’s infrastructure and then obtained visibility into the group’s C2 management platform, database, server logs, source code, and operator files.

The data showed that the hackers ran a large-scale espionage operation and “an industrial-scale cryptocurrency fraud business.”

“Jewelbug’s victim database holds more than one million implant check-in rows, more than 580,000 stolen browser cookies, several thousand captured credentials, and more than 2,300 exfiltrated email bodies,” Symantec researchers note.

Regarding the espionage part, Jewelbug targeted government and military organizations across the Middle East, Southeast Asia, and South Asia.

“Runtime server logs recorded roughly 1.1 million geolocation events against approximately 4,300 distinct source IP addresses: approximately 87,200 connections from a Southeast Asian country (targeting state telecom and military networks), approximately 53,100 from a Middle Eastern country (across the national carrier’s ranges, including Starlink-connected addresses in the capital), and approximately 15,000 from a second Southeast Asian country (including government ministry infrastructure),” Symantec says.

The researchers explained that the threat actor obtained write access to the webmail installation used by multiple government ministries and agencies after compromising a shared web-hosting platform operated by the state telecommunications provider and national services agency.

By injecting a single script tag, the threat actor ensured that the JavaScript payload opened a WebSocket to the C2 every time a user on one of nine government domains logged in.

“A single campaign spanned more than 15 government webmail tenants, with the hook firing on the login page and every mailbox view,” Symantec says.

The cryptocurrency theft operations are backed by AI-generated articles driving traffic to fake crypto exchange sites and click-fraud bots that manipulate search rankings.

According to the researchers, the threat actor relies on an automated attack pipeline that scrapes keywords, generates thousands of fake download pages using AI, and publishes them “across a 44-server content-management fleet and hundreds of lookalike domains” impersonating OKX and Binance. Using click bots, Jewelbug manipulates rankings to promote their fraudulent pages.

The fraud uses other lures, as well: sports betting, pirated livestream portals, and private detective scams.

Symantec researchers have high confidence attributing Jewelbug’s financially-motivated activities to a Chinese company that advertises SEO services.

Jewelbug also uses a Rust-based implant called ‘ClientKing’ that targets Linux servers, ARM64 devices, and ASUS routers, and supports command execution, SOCKS proxying, DNS tunneling, and in-memory kernel module loading.

The hackers used public Google Docs to host obfuscated payloads retrieved and executed by their implants, helping the malicious traffic blend in with legitimate Google services.

Symantec published indicators of compromise related to observed Jewelbug activity, as well as a more detailed technical report describing the threat actor’s tooling and tradecraft, their financial operation, and the infrastructure used in attacks.