The cyber threat group known as Jewelbug, linked to China, has been identified conducting cyber espionage against government and military entities while simultaneously engaging in cryptocurrency fraud. These dual operations are managed through a unified control panel called XG-Web, a browser-based remote-access and information-stealing framework that transforms a victim’s browser into a comprehensive remote-control channel, extending its reach into the host system and internal networks.
Jewelbug is believed to be a China-based group operating as hackers-for-hire, executing parallel missions that include espionage targeting governments and militaries across the Middle East, Southeast Asia, and South Asia, alongside a for-profit cryptocurrency fraud scheme. The group has developed multiple generations of command-and-control (C&C) code and a suite of implants affecting browsers, Windows endpoints, Linux servers, and network devices, all feeding into a centralized database of victims. This toolset supports both their espionage activities and their financially motivated crypto fraud targeting Chinese-speaking individuals.
Investigations have revealed that at least one operator is associated with a registered company in Hunan Province. Jewelbug’s activities overlap with other threat clusters tracked as CL-STA-0049, Earth Alux, and REF7707. Notably, in October 2025, the group was linked to a five-month intrusion targeting a Russian IT service provider, deploying malware designed to disrupt security tools.
Further analysis uncovered a campaign list detailing espionage efforts aimed at government organizations in the Middle East and Southeast Asia, as well as over 90 police and government email addresses in South Asia. The group’s Linux and router implants enable them to infiltrate network infrastructure, with some configurations designed to communicate through the internal corporate proxy of a major U.S. aerospace and industrial manufacturer.
Concurrently, Jewelbug has conducted financially motivated operations targeting Chinese-speaking cryptocurrency users through fake exchange download portals. The use of decoy documents impersonating Taiwanese government entities suggests that their targeting may also extend to Taiwan.
At the core of these operations is XG-Web, a browser-centric remote-access and information-stealing platform built as a React panel over a Node.js backend with a MySQL database. Described by its developers as a penetration-testing platform, XG-Web includes a scheduled job that checks the group’s own C&C infrastructure against VirusTotal every 12 hours for rapid rotation. It also uses public Google Docs to host obfuscated payloads, which are retrieved and executed by their implants. These payloads are XOR encoded with random keys to ensure uniqueness, and the C&C hostnames are disguised to resemble common resources like Google Fonts.
The primary implant utilized is a malicious browser extension named “PDF Viewer,” compatible with both Google Chrome and Mozilla Firefox. Once installed, it requests extensive permissions to access cookies, the debugger, native messaging, run scripts, intercept web requests, and monitor downloads across all sites. This extension enables the execution of arbitrary JavaScript on any web page, remote interaction with the web browser, and credential harvesting by hooking login forms, cookies, browsing history, bookmarks, screenshots, clipboard, and web traffic.
Jewelbug’s sophisticated use of XG-Web underscores the evolving nature of cyber threats, where state-sponsored actors blend espionage with financial crimes. Organizations must remain vigilant, implementing robust security measures and continuously monitoring for such advanced persistent threats to safeguard sensitive information and maintain operational integrity.
