The cyber threat group known as Jewelbug, reportedly linked to China, has been actively involved in cyber espionage targeting government and military entities while also conducting cryptocurrency fraud. This dual operation is managed through a single platform called XG-Web, which facilitates remote access and information theft by converting victim browsers into control channels, Broadcom’s Symantec and Carbon Black Threat Hunter Team revealed.
Jewelbug: A Dual-Purpose Threat
Jewelbug is categorized as a hackers-for-hire group based in China, executing parallel operations. These include espionage activities directed at governments and militaries in regions such as the Middle East and Southeast Asia, alongside a cryptocurrency fraud scheme. The group has developed a comprehensive suite of command-and-control code across various platforms, feeding a centralized victim database.
Symantec’s findings indicate that Jewelbug’s operations utilize a variety of tools and platforms, including browser extensions and network implants. A significant aspect of their espionage involves targeting police and government email systems across South Asia and other regions.
Technical Arsenal and Methodology
The threat actor employs a sophisticated browser-centric platform called XG-Web, which utilizes a React panel with a Node.js backend. This setup allows Jewelbug to check their command-and-control infrastructure against VirusTotal every 12 hours for quick updates. The platform also uses Google Docs to host obfuscated payloads, ensuring the payloads remain undetected.
Jewelbug’s primary tool is a malicious browser extension named “PDF Viewer,” compatible with both Chrome and Firefox. This extension can access cookies, run scripts, and intercept web traffic, among other functions. It also has a clipper module designed to replace cryptocurrency wallet addresses, although evidence of its use during campaigns remains absent.
Espionage Scale and Financial Schemes
The scale of Jewelbug’s espionage is extensive, involving over a million implant check-ins and the theft of numerous credentials. Their operations have spanned multiple countries, targeting key infrastructures, including telecom and military networks. The group also runs a financial operation masquerading as a legitimate Chinese company offering SEO services, which in reality involves SEO poisoning to create fake cryptocurrency exchange sites.
This operation highlights the blurred lines between nation-state hacking and cybercrime, as Jewelbug combines espionage with profit-driven fraud. Symantec and Carbon Black emphasized the uniqueness of Jewelbug, noting the combination of espionage and cryptocurrency fraud within a single group, reflecting a hack-for-hire model.
In conclusion, the activities of Jewelbug demonstrate the evolving landscape of cyber threats, where nation-state actors engage in both political espionage and economic crimes. Their operations underscore the need for enhanced cybersecurity measures and vigilance among potential targets worldwide.
