A Chinese-linked cyber threat actor known as Jewelbug has been observed conducting both cyber espionage operations targeting governments and militaries in various regions of the world, as well as engaging in cryptocurrency fraud This article explores china based hackers. . "Both missions are managed from a single control panel, XG-Web, which is a browser-centric remote-access and information-stealing framework that turns a victim's browser into a full remote-control channel, allowing it to penetrate their host systems and internal networks," Broadcom's Symantec and Carbon Black Threat Hunter Team reported.
Jewelbug is assessed as a China-based hackers-for-hire group operating parallel operations, including espionage against governments and militaries across the Middle East, Southeast Asia, and South Asia, as well as a for-profit cryptocurrency fraud business.
After installation, it demands extensive permissions to access cookies, the debugger, and native messaging capabilities, enabling scripts execution, intercepting web requests, monitoring downloads across all sites, and even harvesting credentials through login forms, cookie manipulation, browsing history, bookmarks, screenshots, clipboard usage, and tracking web traffic remotely. The watering hole campaign spanned 15 government webmail tenants, with malicious code activating on login pages and mailbox views to exfiltrate cookies over WebSocket connections and serve a next-stage payload that checks if the victim email address is among targeted domains, accounts have not been compromised, and systems run Windows before displaying a fake Adobe Flash update prompt.
