Reported by 3 outlets

Timeline

1. original reporting

   Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side

   malware.news · 61d ago · August 13th, 2026

   China-based hackers-for-hire group is breaking into government ministries across the Middle East and Asia from the same control panel it uses to run an industrial-scale cryptocurrency fraud business. Article Link: https://www.security.com/threat-intelligence/jewelbug-crypto-fraud-espionage

2. update from gbhackers.com

   Jewelbug Uses Public Google Docs as Malware Command-and-Control Delivery Channel

   gbhackers.com · 61d ago · August 13th, 2026

   A China-linked threat group tracked as Jewelbug has turned public Google Docs into a resilient command-and-control delivery channel, embedding freshly obfuscated malware payloads in documents that victim implants retrieve and execute. The technique allows malicious traffic to resolve through Google-owned infrastructure, helping the operators blend into legitimate web activity and potentially evade reputation-based filtering. Jewelbug, […] The post Jewelbug Uses Public Google Docs as Malware Command-and-Control Delivery Channel appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from bleepingcomputer.com

   Hackers breach govt webmail while running parallel crypto fraud

   bleepingcomputer.com · 61d ago · August 13th, 2026

   The Jewelbug hacker group has been carrying out espionage operations targeting governments and militaries while also engaging in cryptocurrency fraud. Although the threat actor has targeted government agencies and organizations in critical sectors, including defense, telecommunications, education, and aviation, its cryptocurrency-related activity suggests that they may also operate as a hack-for-hire group that seeks to profit from cybercrime. In a recent operation, Jewelbug (also known as Earth Alux and REF7707) compromised webmail accounts belonging to 15 government tenants as part of a campaign targeting a country in the Middle East. Researchers at Symantec found that the espionage campaign and the cryptocurrency fraud were conducted from the same control panel. The China-based hacker group gained write access to the shared webmail installation and inserted a malicious script into its common template. The script then ran on login pages and mailbox views across 15 tenants. The webmail attack chain Source: Symantec After execution, the script established a WebSocket connection to the attacker's command-and-control (C2) server, exfiltrated webmail cookies, and retrieved the user's email address to determine whether it belonged to a targeted government domain. Valuable targets would receive a fake Adobe Flash update prompt, which installs the main payload on Windows, the Antino backdoor, and browser tooling.