Home › Threat Actors › Jewelbug (Earth Alux / Ink Dragon / REF7707 / CL-STA-0049)
← All Threat Actors
Nation-State high China; activity patterns consistent with UTC+8. One operator handle was tied by researchers to a legally registered SEO company in Changsha, Hunan Province.

Jewelbug (Earth Alux / Ink Dragon / REF7707 / CL-STA-0049)

China-based threat actor assessed by Broadcom as a hackers-for-hire operation — likely contracted by state or quasi-state clients for espionage while independently running a for-profit cryptocurrency fraud business from the same infrastructure. · Dual: state-aligned intelligence collection (government, military, telecom espionage) and independent, profit-driven cybercrime (cryptocurrency fraud).

Reports 1
Active Since Earth Alux/REF7707 lineage tracked since at least 2025; Jewelbug identity unified by Broadcom on 13 August 2026
Last Reported 19 Aug 2026
Sectors Targeted communications, critical-infrastructure, finance

Tactics, Techniques & Procedures (TTPs)

  • Watering-hole compromise of a shared webmail hosting provider to inject malicious JavaScript across 15+ government ministry tenants simultaneously
  • Historical (Earth Alux/REF7707) initial access via webshells on vulnerable internet-facing IIS and SharePoint servers
  • XG-Web — a React/Node.js/MySQL C2 panel administering both espionage implants and crypto-fraud campaigns; self-submits payloads to VirusTotal every 12 hours to monitor detection and rotate infrastructure
  • Malicious 'PDF Viewer' browser extension requesting broad permissions; escapes the sandbox via a native-messaging host; contains a dormant cryptocurrency clipboard-swapping function
  • Antino Windows backdoor, delivered via malicious HTA downloaders/fake Adobe installers, using the Microsoft Graph API as its C2 channel
  • ClientKing — a Rust-based Linux/router implant with five C2 channels including DNS tunneling, SOCKS proxy pivoting, and su/sudo credential hooking
  • Historical malware families under the Earth Alux/REF7707 identity: COBEACON, VARGEIT, and FinalDraft
  • Crypto-fraud pipeline: AI-generated fake Binance/OKX exchange pages distributed across 40+ CMS servers and hundreds of lookalike domains, marketed on Telegram as an SEO service

Known Targets

Government and military entities across the Middle East, Southeast Asia, and South AsiaTelecommunications and national carrier infrastructure in the Middle East and Southeast AsiaA major US aerospace/industrial manufacturer (internal proxy compromise)A Russian IT service provider (five-month intrusion starting ~October 2025)Taiwanese government entities (via decoy documents)Chinese-speaking cryptocurrency users globally (fraud side)

Analyst Notes

Broadcom's disclosure (13 Aug 2026) is the first to unify this actor's fragmented vendor aliases and expose its dual espionage/crypto-fraud business model. Observed infrastructure logged over 1 million implant check-ins, 580,000+ stolen cookies, and ~2,300 exfiltrated email bodies in under three months of monitoring.

Also Known As

Earth AluxInk DragonREF7707CL-STA-0049

MITRE ATT&CK Techniques

T1189 Drive-by Compromise T1505.003 Server Software Component: Web Shell T1176 Browser Extensions T1572 Protocol Tunneling

Intelligence Reports

Analysis communicationscritical-infrastructure

Jewelbug: The China-Linked Hack-for-Hire Crew Running Espionage and Crypto Fraud From One Panel

Broadcom researchers have exposed Jewelbug, a China-based threat actor that breached 15 government webmail tenants in a single Middle Eastern intrusion while operating a parallel million-dollar cryptocurrency fraud scheme from the same control infrastructure.

19 Aug 2026 · 11 min read