China-Linked Jewelbug Group Uses XG-Web for Espionage and Crypto Fraud

Dual Operations of Jewelbug

The threat actor known as Jewelbug, assessed to be a China-based hackers-for-hire group, has been observed conducting two distinct but parallel operations. These include cyber espionage targeting government and military entities, and financially motivated cryptocurrency fraud. Both missions are managed from a single control panel, XG-Web.

XG-Web Framework

XG-Web is described as a browser-centric remote-access and information-stealing framework. It transforms a victim's browser into a remote-control channel, allowing access to the host system and the internal network. Broadcom's Symantec and Carbon Black Threat Hunter Team identified this framework as central to Jewelbug's operations.

Espionage Targets and Reach

Jewelbug's espionage activities focus on governments and militaries across the Middle East, Southeast Asia, and South Asia. Symantec's investigation uncovered campaign lists detailing espionage against government organizations in these regions, including over 90 police and government email addresses in South Asia. The group also uses Linux and router implants to extend its reach into network infrastructure, with some builds configured to beacon through internal corporate proxies of major U.S. aerospace and industrial manufacturers.

Cryptocurrency Fraud

In parallel with espionage, Jewelbug engages in cryptocurrency fraud targeting Chinese-speaking users. This operation involves using fake exchange-download portals to deceive victims. Decoy documents impersonating Taiwanese government entities suggest a broader targeting scope within this financially motivated activity.

Attribution and Overlaps

At least one operator associated with Jewelbug is linked to a registered company in Hunan Province. The group overlaps with other tracked threat clusters, including CL-STA-0049 (Palo Alto Networks Unit 42), Ink Dragon (Check Point), Earth Alux (Trend Micro), and REF7707 (Elastic Security Labs). In October 2025, the group was attributed to a five-month intrusion against a Russian IT service provider, deploying malware designed to interfere with security tools.