China-linked Jewelbug group conducts espionage and cryptocurrency theft

A mercenary advanced persistent threat (APT) group based in China, known as Jewelbug, is engaged in both international cyber espionage and cryptocurrency theft, according to a recent report by Symantec, with further coverage provided by Dark Reading.

Jewelbug operates a single, custom command-and-control (C2) panel to manage its dual operations. The group utilizes three primary custom malware implants: Antino (Windows backdoor), ClientKing (Linux backdoor), and a browser extension named "PDF Viewer." This extension is particularly versatile, capable of stealing cookies, session tokens, and screenshots, injecting JavaScript, and potentially replacing cryptocurrency addresses during transactions. For its cryptocurrency fraud operations, Jewelbug creates thousands of fake cryptocurrency and betting websites, boosted by click-fraud bots and sophisticated filtering to target victims.

The group has compromised government, military, and telecommunications organizations in Asia and the Middle East, as well as a major U.S. industrial manufacturer. Symantec researchers discovered hundreds of thousands of stolen cookies and thousands of login credentials, indicating a significant number of victims. The scale and nature of Jewelbug's activities suggest it is likely operating on behalf of a Chinese state agency or for its own gain with the intent to sell stolen information to government contacts.

Source: Dark Reading