China-linked APT Jewelbug targets Russian IT provider in rare cross-nation cyberattack

China-linked APT Jewelbug, also known as CL-STA-0049, Earth Alux, and REF7707, carried out a five-month intrusion on a Russian IT service provider, marking a rare cross-nation campaign, according to Symantec Threat Hunter Team researchers. The operation, which began in January 2025 and continued through May 2025, targeted multiple entities including a Russian company, a South American government department, and IT firms in Taiwan and South Asia, with exfiltration to Yandex Cloud to evade detection.

The attackers accessed code repositories and build systems, suggesting potential supply chain risks for customers in Russia, and used a renamed Microsoft debugger file, 7zup.exe, to execute shellcode and bypass whitelisting while disabling security tools. They dumped credentials, established persistence via scheduled tasks, and deployed a new backdoor that uses Microsoft Graph API and OneDrive as C2, while also leveraging DLL sideloading, SMBExec, and other techniques for lateral movement.

The report notes that Jewelbug’s activity indicates ongoing development of its toolset and a broader reach beyond its traditional regional focus. according to Symantec Threat Hunter Team, IT service providers remain attractive targets for supply chain operations that could affect a large number of organisations simultaneously.