Threat actor
Jewelbug
China
Tracked by CyberSIXT since 15 Oct 2025
- Articles · all time
- 7
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 3
9 articles from 1 outlet since 15 Oct 2025; the latest 24 days ago.
- Article
- Research report
Show as table
Names and sources
- REF7707
- Named by CyberSIXT coverage
- CL-STA-0049
- Named by Malpedia · ref7707
- Jewelbug
- Named by Malpedia · ref7707
- REF7707
- Named by Malpedia · ref7707
- CL-STA-0049
- Named by MISP Galaxy · ff080026-9df7-4874-ad04-0c7d4dcb3e7f
- Jewelbug
- Named by MISP Galaxy · ff080026-9df7-4874-ad04-0c7d4dcb3e7f
- REF7707
- Named by MISP Galaxy · ff080026-9df7-4874-ad04-0c7d4dcb3e7f
- Jewelbug APT
- Named by CyberSIXT coverage
All 9 names
- ff080026-9df7-4874-ad04-0c7d4dcb3e7f
- Named by CyberSIXT coverage
Attributed facts
- origin
- China (MISP Galaxy · ff080026-9df7-4874-ad04-0c7d4dcb3e7f)
- China-Linked Hackers Hide Antino Espionage in Microsoft 365 TrafficSecurityOnline
- Jewelbug APT uses fake updates to spy on governmentsSecurityOnline
- Chinese hack for hire Jewelbug blends espionage with crypto fraudInfosecurity
- Jewelbug APT mixes espionage, crypto theft via custom malwareDark Reading
- China-Linked Ink Dragon Hacks Governments Using ShadowPad and FINALDRAFT MalwareThe Hacker News
- Elastic detects stealthy NANOREMOTE malware using Google Drive as C2Security Affairs
- China-linked APT Jewelbug targets Russian IT provider in rare cross-nation cyberattackSecurity Affairs
- China’s Jewelbug APT Breaches Russian IT Provider for 5 Months, Using Yandex Cloud and Graph API C2SecurityOnline
- Chinese Threat Group 'Jewelbug' Quietly Infiltrated Russian IT Network for MonthsThe Hacker News · first in our coverage