Executive Summary
Jewelbug (also known as Earth Alux or REF7707) is a China-based hackers-for-hire group that simultaneously manages state-sponsored espionage and financial fraud. The group utilizes a unified control panel, XG-Web, to manage multiple malware families targeting government ministries, telecommunications providers, and cryptocurrency users. Their operations are tied to a registered company in Hunan Province, China, suggesting a 'hack-for-hire' model where legitimate business infrastructure is repurposed for offensive cyber operations.
The group's technical tradecraft is characterized by high-volume data theft and versatile cross-platform tooling. They have successfully compromised national webmail systems in the Middle East via watering-hole attacks and utilized legitimate Microsoft Graph API and Google Docs for command-and-control (C2) communication. Their impact is significant, with telemetry revealing over one million implant check-ins and the theft of nearly 600,000 browser cookies in a three-month window.
Organizations in the Middle East and Southeast Asia, particularly those in government and telecommunications, face the highest risk. The group's ability to pivot from browser-based extensions to internal network infrastructure via native messaging hosts and industrial-grade Linux implants like ClientKing represents a sophisticated threat to both data privacy and internal system integrity.