Chinese Threat Group 'Jewelbug' Quietly Infiltrated Russian IT Network for Months

According to Symantec, Jewelbug—a threat actor with ties to China—has been attributed to a five-month intrusion targeting a Russian IT service provider, spanning January to May 2025. The report notes that attackers had access to code repositories and software build systems, and exfiltrated data to Yandex Cloud, while also deploying a renamed Microsoft Console Debugger (cdb.exe) to run shellcode and bypass allowlists.

Jewelbug is described as using a mix of legitimate cloud services and tools to establish a stealthy, persistent presence, and to conceal traces by clearing Windows Event Logs. The investigation ties Jewelbug to activity clusters CL-STA-0049 (Palo Alto Networks Unit 42) and REF7707 (Elastic Security Labs), with Earth Alux (Trend Micro) also mentioned in relation to related campaigns.

The findings mark the first linkage of these clusters and underscore the group’s evolving capabilities, including a backdoor named FINALDRAFT (aka Squidoor) observed in related operations.