Researchers Link 'Jewelbug' Chinese APT to Hack-for-Hire Operations

Broadcom's Threat Hunter Team attributes a dual-purpose operation to Jewelbug (Ink Dragon/REF770): sophisticated cyber espionage targeting governments across the Middle East, South and Southeast Asia alongside a Chinese-language cryptocurrency fraud scheme. The report highlights shared infrastructure (the XG-Web browser-based C2 and backend), tooling including the Antino Windows backdoor, ClientKing Linux/router implant, a malicious browser extension and abuse of Microsoft Graph and Google Docs for C2 and payload delivery; researchers observed over one million implant check-ins, ~580,000 stolen browser cookies, watering‑hole campaigns on government webmail tenants, and clear operational overlap between espionage and financial fraud.