When Spies Also Run Crypto Scams

The Jewelbug threat actor has been running two very different operations from the same control panel. On one side, the group targets government and military networks with webshells and backdoors. On the other, it runs a crypto fraud business that uses AI-generated content and click bots to push fake exchange sites. Symantec researchers traced both lines of work back to the same infrastructure, revealing a single group that wears two hats.

Webmail Compromise Hits 15 Government Tenants

In a recent campaign, Jewelbug compromised webmail accounts belonging to 15 government tenants in a Middle Eastern country. The group gained write access to a shared webmail installation, then inserted a malicious script into its common template. That script ran on login pages and mailbox views across all 15 tenants, affecting every user on those domains.

The script established a WebSocket connection to the attacker's command-and-control server, exfiltrated webmail cookies, and retrieved the user's email address. That address was checked against a list of targeted government domains. Valuable targets received a fake Adobe Flash update prompt, which delivered the main Windows payload: the Antino backdoor and browser tooling.

Antino Backdoor and the XG-Web Framework

Symantec notes that Jewelbug delivers Antino through malicious HTA files and fake Adobe Flash or Adobe installers. Once installed, Antino can deploy additional payloads. One of those is a browser extension for Chrome and Firefox called PDF Viewer, which steals cookies and credentials, intercepts traffic, injects JavaScript, and remotely exposes browser functions.

The group also relies on the XG-Web remote-access and data-theft framework to manage campaigns and victim information. Symantec traced Antino infections back to Jewelbug's infrastructure, then obtained visibility into the group's C2 management platform, database, server logs, source code, and operator files. That access gave researchers a window into both the espionage and financial sides of the operation.

Inside the Victim Database

“Jewelbug’s victim database holds more than one million implant check-in rows, more than 580,000 stolen browser cookies, several thousand captured credentials, and more than 2,300 exfiltrated email bodies,”

— Symantec researchers

• More than one million implant check-in rows
• More than 580,000 stolen browser cookies
• Several thousand captured credentials
• More than 2,300 exfiltrated email bodies

Those numbers come straight from the database Symantec analyzed, and they give a sense of scale. The theft of email bodies suggests the group is reading messages, not just harvesting passwords. The implant check-ins show a botnet-like structure, with many machines reporting back to the C2 over time.

Espionage Targets Across Three Regions

For its espionage work, Jewelbug concentrated on government and military organizations in the Middle East, Southeast Asia, and South Asia. Runtime server logs recorded roughly 1.1 million geolocation events against approximately 4,300 distinct source IP addresses. The breakdown shows how spread out the targets were: about 87,200 connections came from a Southeast Asian country, targeting state telecom and military networks; about 53,100 came from a Middle Eastern country, across the national carrier’s ranges, including Starlink-connected addresses in the capital; and about 15,000 came from a second Southeast Asian country, including government ministry infrastructure.

The webmail compromise itself fits into a broader pattern. The threat actor obtained write access to the webmail installation after compromising a shared web-hosting platform run by the state telecommunications provider and national services agency. A single script tag injected into that platform meant that every time a user on one of nine government domains logged in, the JavaScript payload opened a WebSocket to the C2.

The Crypto Fraud Side

Beyond espionage, Jewelbug ran what Symantec describes as “an industrial-scale cryptocurrency fraud business.” The operation relied on AI-generated articles to drive traffic to fake crypto exchange sites, with click-fraud bots manipulating search rankings. The automated pipeline scraped keywords, generated thousands of fake download pages using AI, and published them “across a 44-server content-management fleet and hundreds of lookalike domains” impersonating OKX and Binance.

The fraud used other lures too, including sports betting, pirated livestream portals, and private detective scams. Symantec researchers said they have high confidence attributing the financial activities to a Chinese company that advertises SEO services, though the link between that company and the espionage work remains part of the same infrastructure.

Additional Tools: ClientKing and Google Docs

Jewelbug also uses a Rust-based implant called ClientKing, which targets Linux servers, ARM64 devices, and ASUS routers. It supports command execution, SOCKS proxying, DNS tunneling, and in-memory kernel module loading. The hackers used public Google Docs to host obfuscated payloads that their implants retrieved and executed, which helped the malicious traffic blend in with legitimate Google services.

Symantec has published indicators of compromise related to observed Jewelbug activity, along with a more detailed technical report describing the group's tooling, tradecraft, financial operation, and infrastructure. Those resources can help defenders look for signs of the same activity in their own environments.

Why It Matters

The fact that one group runs both espionage and crypto fraud from the same command infrastructure complicates the threat picture. It suggests that state-aligned actors may also be motivated by profit, and that defenders cannot assume a single attack chain leads to a single outcome. The webmail compromise alone is a reminder that shared hosting platforms can become a single point of failure, affecting dozens of organizations at once. As attackers continue to blend espionage with financial crime, the line between nation-state hacking and cybercrime may keep blurring, which could mean that even smaller organizations face threats that were once the domain of state actors. Organizations in critical sectors should review the indicators of compromise and technical guidance from Symantec to determine if any of the observed activity overlaps with their own networks.