Breach Government Webmail

Overview

The Jewelbug hacker group (also tracked as Earth Alux and REF7707) has been conducting espionage operations against governments and militaries while simultaneously running large‑scale cryptocurrency fraud schemes. Recent findings from Symantec reveal that both campaigns were managed from the same control panel, underscoring Jewelbug’s dual focus on state‑level espionage and financial cybercrime.

Government Webmail Breach

• Compromised tenants: Jewelbug infiltrated webmail accounts belonging to 15 government tenants in a Middle Eastern country.
• Attack chain:
  • Malicious script injected into shared webmail templates.
  • Script executed on login pages and mailbox views.
  • Established WebSocket connections to attacker C2 servers.
  • Exfiltrated cookies and email addresses to identify government domains.
• Payload delivery: High‑value targets received fake Adobe Flash update prompts, installing the Antino backdoor and browser tooling.

Tooling and Tradecraft

• Antino backdoor: Delivered via malicious HTA files and fake installers, enabling further payload deployment.
• XG‑Web framework: Used for campaign management and victim data theft.
• PDF Viewer extension: Malicious Chrome/Firefox add‑on that steals cookies, credentials, intercepts traffic, and injects JavaScript.
• ClientKing implant: Rust‑based malware targeting Linux servers, ARM64 devices, and ASUS routers, supporting command execution, SOCKS proxying, DNS tunneling, and kernel module loading.

Espionage Operations

• Target regions: Middle East, Southeast Asia, and South Asia.
• Telemetry data:
  • ~87,200 connections from a Southeast Asian country (telecom & military networks).
  • ~53,100 from a Middle Eastern country (national carrier ranges, including Starlink addresses).
  • ~15,000 from another Southeast Asian country (government ministry infrastructure).
• Scale: Jewelbug’s victim database contained over 1 million implant check‑ins, 580,000 stolen cookies, and 2,300 exfiltrated email bodies.

Cryptocurrency Fraud Operations

• Automated pipeline: AI‑generated articles drive traffic to fake crypto exchange sites.
• Click‑fraud bots: Manipulate search rankings to promote fraudulent pages.
• Infrastructure: 44‑server content‑management fleet and hundreds of lookalike domains impersonating OKX and Binance.
• Other lures: Sports betting, pirated livestream portals, and private detective scams.
• Attribution: Symantec links financially motivated activity to a Chinese company advertising SEO services.

Defensive Guidance

Organizations should:

• Audit shared webmail platforms for unauthorized script injections.
• Monitor browser extensions for suspicious add‑ons like “PDF Viewer.”
• Restrict access to sensitive tenants and enforce strong authentication.
• Detect AI‑driven fraud by monitoring for lookalike domains and click‑fraud traffic.
• Review IoCs published by Symantec to identify compromised systems.

Expert in the Cloud Insight

Jewelbug exemplifies the convergence of espionage and cybercrime, leveraging the same infrastructure to steal state secrets and run industrial‑scale crypto fraud. Their use of AI‑generated content, SEO manipulation, and multi‑platform implants shows how threat actors are evolving beyond traditional APT boundaries. For defenders, the lesson is clear: government systems and financial ecosystems are now intertwined targets, requiring unified monitoring and rapid response.