The Jewelbug hacker group has been carrying out espionage operations targeting governments and militaries while also engaging in cryptocurrency fraud.

Researchers discovered hackers-for-hire performing cyber espionage and financially motivated heists from the same Web panel.

China-linked APT Jewelbug targeted a Russian IT provider for five months in 2025, showing Russia remains exposed to Chinese cyber espionage. China-linked threat actor Jewelbug (aka CL-STA-0049, Earth Alux, and REF7707) carried out a five-month intrusion on a Russian IT service provider, marking its expansion beyond Southeast Asia and South America. The campaign, reported by […]

The Jewelbug hacker group has been carrying out espionage operations targeting governments and militaries while also engaging in cryptocurrency fraud. [...]

China-linked APT Jewelbug targeted a Russian IT provider for five months in 2025, showing Russia remains exposed to Chinese cyber espionage.

Chinese group Jewelbug hacked a Russian IT provider, exploiting Microsoft tools and exfiltrating data via Yandex Cloud.

Chinese group Jewelbug hacked a Russian IT provider, exploiting Microsoft tools and exfiltrating data via Yandex Cloud.

A threat actor with ties to China has been attributed to a five-month-long intrusion targeting a Russian IT service provider, marking the hacking group's expansion to the country beyond Southeast Asia and South America. The activity, which took place from January to May 2025, has been attributed by Broadcom-owned Symantec to a threat actor it tracks as Jewelbug, which it said overlaps with

Introduction: Advanced Persistent Threat (APT) groups are evolving faster than traditional defenses, with the latest escalation coming from Webworm (also tracked as Jewelbug), a China-aligned espionage actor. In its 2025 campaigns targeting European governments, Webworm unveiled a sophisticated new backdoor known as GraphWorm. This malware represents a growing, dangerous trend among threat actors: abusing legitimate cloud infrastructure—specifically Microsoft OneDrive via the Microsoft Graph API—to disguise malicious command-and-control (C2) traffic as normal enterprise activity.

: Who needs enemies when you have friends like Xi?