A China-based mercenary hacking group compromised the webmail of more than 15 government tenants in a single Middle Eastern country with one planted script, while simultaneously running a for-profit cryptocurrency fraud business from the same control panel, the same servers and the same small team. The findings come from a months-long investigation by Broadcom's Symantec Threat Hunter Team, published August 13, 2026, and subsequently covered by BleepingComputer, SC Media, Infosecurity Magazine, Dark Reading and others. Symantec's own writeup puts the harvest at more than one million implant check-in rows and more than 580,000 stolen browser cookies in under three months of active operation. The group is tracked as Jewelbug by Symantec and as Earth Alux, REF7707 and CL-STA-0049 by other labs; Infosecurity Magazine additionally lists Ink Dragon among its aliases and renders one alias as REF770 rather than REF7707, a discrepancy the sources do not reconcile.
What Happened
Jewelbug has been active since at least the second quarter of 2023, according to Tech Times, and has previously been reported on by Trend Micro, Palo Alto Networks' Unit 42 and Check Point Research. What is new in the August 13 report is not the group's China nexus, which was already suspected, but the demonstration that its espionage arm and its crypto-fraud arm are one operation.
"The two are not separate ventures that happen to share a name: our investigation revealed they are run by the same small team, on shared infrastructure, from one control panel," Symantec's researchers wrote, in a line quoted by Infosecurity Magazine, Security Boulevard and Symantec's own publication.
The flagship intrusion targeted a shared web-hosting platform operated by a state-owned telecommunications and network services provider in a Middle Eastern country. Having obtained write access to the shared webmail installation, the operators inserted a malicious script into the platform's common template. Because every ministry on that platform drew from the same template, the script propagated to more than 15 government webmail tenants at once, executing on login pages and on every mailbox view. Tech Times reports the script was disguised as a routine Google Fonts asset; that specific detail appears in only that source and should be treated as unconfirmed.
Note a small but real inconsistency across the coverage: BleepingComputer describes "15 government tenants," while Symantec, TechNadu and OffSeq all say "more than 15." The figure is a floor, not a precise count, and the affected country is not named in any source.
Beyond that operation, the group has compromised government, military, telecommunications, defense, education and aviation organizations across the Middle East, South Asia and Southeast Asia. SC Media, citing Symantec and Dark Reading, adds a major U.S. industrial manufacturer to the victim list; Symantec's own account describes the target more specifically as "a major U.S. aerospace and industrial manufacturer" and says one set of implants was configured to route through that company's internal proxy.
What Was Taken
Figures vary in specificity by source, and the ranges matter:
- Browser cookies: more than 580,000 stolen, per Symantec, TechNadu and OffSeq. SC Media describes the same finding less precisely as "hundreds of thousands of stolen cookies."
- Implant check-ins: more than one million rows in the victim database, per Symantec, TechNadu and OffSeq, accumulated in less than three months of active operations.
- Credentials: "several thousand captured credentials," per Symantec, consistent with SC Media's "thousands of login credentials."
- Email content: more than 2,300 exfiltrated email bodies, a figure reported by TechNadu quoting the Symantec report and not independently repeated elsewhere in this source set.
The sensitivity is the point. Because the compromise sat at the webmail layer of a shared government platform, the collection surface included ministries, intelligence bodies and security services on the same host. Session cookies and tokens, not just passwords, were the primary take, which means multi-factor authentication at login did not stop the attacker from riding an already-authenticated session.
Why It Matters
Three things separate this from routine APT reporting.
First, the shared-tenancy failure mode. National governments frequently consolidate ministry email onto a single state telecom or hosting provider for cost and control reasons. Jewelbug demonstrated that this consolidation converts one hosting-provider compromise into simultaneous access to an entire government's correspondence. The attacker did not need 15 intrusions; it needed one, at the right layer.
Second, the blending of state-aligned espionage with commodity cybercrime. Symantec's assessment, as relayed by SC Media, is that Jewelbug is likely operating on behalf of a Chinese state agency, or for its own gain with intent to sell stolen material to government contacts. Security Boulevard notes Symantec has previously documented China-linked espionage crews "moonlighting" on ransomware, but frames Jewelbug as a step beyond that: two missions, one set of hands, running concurrently rather than opportunistically. For defenders, that collapses the usual triage shortcut of sorting an alert into "criminal, therefore lower priority" or "espionage, therefore targeted."
Third, attribution has moved from infrastructure to people. Infosecurity Magazine reports that Broadcom identified an operator in the control panel under the handle 'ople500', linked to a 'paopaodada' ("bubble boss") persona advertised on Telegram as the contact for a "website ranking rental" service, and associated "with high confidence" to an SEO company registered in Changsha, Hunan Province. Broadcom says it identified that company's sole legal representative by name and assessed that this person supplies access, infrastructure and delivery to the espionage operation rather than operating alongside the team. Symantec's own summary states the identification came from government-issued identity documents belonging to the operators. The company is unnamed in public reporting.
The Attack Technique
The webmail chain, as described by BleepingComputer and Symantec, ran as follows. The injected script opened a WebSocket connection to the attacker's command-and-control server, exfiltrated webmail cookies, and read the victim's email address to determine whether it belonged to a targeted government domain. Sessions that passed that filter were enlisted into the operators' panel; high-value users were then served a fake Adobe Flash update prompt that installed the Windows payload.
The tooling stack:
- XG-Web: the single custom C2 panel used to administer both the espionage and fraud operations. Symantec describes it as a browser-centric remote-access and information-stealing framework that turns a victim's browser into a full remote-control channel and reaches from there into the host and the internal network behind it.
- Antino: the main Windows backdoor, delivered via malicious HTA files and fake Adobe Flash or Adobe installers, then used to stage further payloads.
- ClientKing: a Linux backdoor, described by TechNadu and OffSeq as also targeting routers.
- "PDF Viewer": a malicious Chrome and Firefox extension that steals cookies, session tokens and screenshots, injects JavaScript, and per SC Media is capable of replacing cryptocurrency addresses during transactions. Symantec reports it is paired with a helper disguised as a Microsoft Edge component that gives operators a command shell on the host.
Initial access outside the webmail campaign typically came through vulnerable IIS and SharePoint servers, per Infosecurity Magazine. Security Boulevard and Symantec both note the group has developed five generations of C2 code, indicating sustained in-house development rather than off-the-shelf tooling.
The fraud side used thousands of fake cryptocurrency and betting websites and fake exchange-download portals aimed at Chinese-speaking users, boosted by click-fraud bots and traffic filtering, per SC Media and Infosecurity Magazine.
What Organizations Should Do
- Audit write access to shared web templates. Any hosting platform serving multiple tenants from a common template is a single point of catastrophic failure. Restrict write permissions, enable file integrity monitoring on template and asset directories, and alert on any change to shared login-page code.
- Inspect third-party script references on authentication pages. The reported lure was a script tag styled to look like a routine web font resource. Enforce Content Security Policy with an explicit allowlist and Subresource Integrity on login and mailbox views, and treat any unexplained external script on an auth page as an incident.
- Treat session cookies as credentials. MFA did not help here because the theft happened post-authentication. Bind sessions to device or IP where feasible, shorten webmail session lifetimes, and force a full session invalidation, not just a password reset, during any suspected webmail compromise.
- Lock down browser extension installation. Both Chrome and Firefox variants of "PDF Viewer" were used for cookie and credential theft. Enforce enterprise extension allowlisting; do not rely on user judgment.
- Block and alert on the published indicators. OffSeq's threat entry lists associated infrastructure including the IP 38.12.1.47 and the domains www.jkskhei.com and ns1.jkskhei.com, alongside a set of file hashes. Feed these into perimeter blocking and retroactive log searches, and pull the full IOC set from the Symantec report rather than relying on partial aggregator lists.
- Hunt on the Linux and network-device side too. ClientKing targets Linux servers and routers, which sit outside most EDR coverage. Review router configurations and Linux persistence mechanisms, and check whether internal proxies are being used to relay implant traffic, as reportedly happened at the U.S. manufacturer.
- Patch internet-facing IIS and SharePoint. These remain the group's reported standard entry route for non-webmail intrusions.
Sources: Jewelbug Spy Ring Hit 15 Ministries in One Strike, Ran Crypto Fraud... | Hackers breach govt webmail while running parallel crypto ... | China-linked Jewelbug group conducts espionage and cryptocurrency t... | Researchers Link Suspected Chinese APT to Hack-for-Hire Operations... | Jewelbug: APT Group Runs Espionage and Crypto Fraud ... | Jewelbug APT: China-Based Govt Espionage and Crypto Fraud Exposed -... | APT Group Runs Espionage and Crypto Fraud Operations Side by Side -... | Jewelbug: A Single Control Panel for Cyberespionage and Fraud