Jewelbug APT Group Engages in Espionage and Cryptocurrency Fraud

• •Jewelbug operates both espionage and cryptocurrency fraud from a single C2 platform.
• •The group has compromised over 15 government webmail accounts, affecting multiple countries.
• •Their malicious browser extension can replace cryptocurrency wallet addresses during transactions.

The Jewelbug APT group, based in China, has been conducting simultaneous cyber espionage and cryptocurrency fraud operations. Utilizing a single command-and-control platform named XG-Web, the group has compromised over 15 government webmail accounts across multiple countries in the Middle East and Asia. Their operations have resulted in the theft of more than 580,000 browser cookies and over 2,300 email bodies. The group employs a malicious browser extension called 'PDF Viewer' that steals sensitive information and can replace cryptocurrency wallet addresses during transactions. Jewelbug's activities have targeted government, military, and telecommunications sectors, indicating a significant scale of operations. The group has registered hundreds of fake cryptocurrency exchange websites, primarily targeting Chinese-speaking victims. Symantec's research highlights that Jewelbug's dual operations blur the lines between state-sponsored espionage and cybercrime for profit.