China’s Jewelbug APT Breaches Russian IT Provider for 5 Months, Using Yandex Cloud and Graph API C2

according to Symantec’s Threat Hunter Team, the Chinese APT group Jewelbug (also tracked as REF7707, CL-STA-0049, and Earth Alux) conducted a global espionage campaign that included an unprecedented intrusion into a Russian IT service provider. The attackers maintained access to the Russian company’s network for the first five months of 2025, gaining entry to software build and code repository systems, with the aim of enabling potential supply-chain attacks against the provider’s customers in Russia.

To avoid detection, Jewelbug exfiltrated stolen data to Yandex Cloud, a legitimate Russian platform, a move researchers say was likely to help conceal the operation. The investigation notes the group’s deployment of a new backdoor that uses Microsoft Graph API and OneDrive for command-and-control, blending malicious traffic with legitimate cloud communications, and confirms activities such as uploading file lists to OneDrive and gathering host metadata. The report also cites a renamed copy of 7zup.exe (a copy of Microsoft’s cdb.exe) as an early indicator, described as a hallmark of Jewelbug activity.