Threat actor
Jewelbug
China
Tracked by CyberSIXT since 15 Oct 2025
- Articles · all time
- 7
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 3
7 articles from 1 outlet since 15 Oct 2025; the latest 67 days ago.
- Article
- Research report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Thu 20 Aug · 08:10 UTC | SecurityOnline | Jewelbug APT uses fake updates to spy on governments |
| Fri 14 Aug · 07:41 UTC | Infosecurity | Chinese hack for hire Jewelbug blends espionage with crypto fraud |
| Thu 13 Aug · 10:32 UTC | Dark Reading | Jewelbug APT mixes espionage, crypto theft via custom malware |
| Wed 17 Dec 2025 · 12:00 UTC | The Hacker News | China-Linked Ink Dragon Hacks Governments Using ShadowPad and FINALDRAFT Malware |
| Thu 16 Oct 2025 · 14:15 UTC | Security Affairs | China-linked APT Jewelbug targets Russian IT provider in rare cross-nation cyberattack |
| Thu 16 Oct 2025 · 02:36 UTC | SecurityOnline | China’s Jewelbug APT Breaches Russian IT Provider for 5 Months, Using Yandex Cloud and Graph API C2 |
| Wed 15 Oct 2025 · 18:50 UTC | The Hacker News | Chinese Threat Group 'Jewelbug' Quietly Infiltrated Russian IT Network for Months |
Names and sources
- REF7707
- Named by CyberSIXT coverage
- CL-STA-0049
- Named by Malpedia · ref7707
- Jewelbug
- Named by Malpedia · ref7707
- REF7707
- Named by Malpedia · ref7707
- CL-STA-0049
- Named by MISP Galaxy · ff080026-9df7-4874-ad04-0c7d4dcb3e7f
- Jewelbug
- Named by MISP Galaxy · ff080026-9df7-4874-ad04-0c7d4dcb3e7f
- REF7707
- Named by MISP Galaxy · ff080026-9df7-4874-ad04-0c7d4dcb3e7f
- Jewelbug APT
- Named by CyberSIXT coverage
All 9 names
- ff080026-9df7-4874-ad04-0c7d4dcb3e7f
- Named by CyberSIXT coverage
Attributed facts
- origin
- China (MISP Galaxy · ff080026-9df7-4874-ad04-0c7d4dcb3e7f)
- Jewelbug APT uses fake updates to spy on governmentsSecurityOnline
- Chinese hack for hire Jewelbug blends espionage with crypto fraudInfosecurity
- Jewelbug APT mixes espionage, crypto theft via custom malwareDark Reading
- China-Linked Ink Dragon Hacks Governments Using ShadowPad and FINALDRAFT MalwareThe Hacker News
- China-linked APT Jewelbug targets Russian IT provider in rare cross-nation cyberattackSecurity Affairs
- China’s Jewelbug APT Breaches Russian IT Provider for 5 Months, Using Yandex Cloud and Graph API C2SecurityOnline
- Chinese Threat Group 'Jewelbug' Quietly Infiltrated Russian IT Network for MonthsThe Hacker News · first in our coverage