Jewelbug Spy Ring Hit 15 Ministries in One Strike, Ran Crypto Fraud From Same Panel

Symantec says a China-linked mercenary hacking group known as Jewelbug—also tracked as Earth Alux, REF7707 and CL-STA-0049—has run simultaneous government espionage across parts of the Middle East, South Asia and Southeast Asia while defrauding Chinese-speaking crypto users. The campaign began at least by Q2 2023, but Symantec’s investigation, published August 13, 2026, detailed how the group compromised an entire national government’s email system with a single move. By breaching a shared web-hosting platform used by one state-owned telecommunications provider, Jewelbug planted a malicious script that spread to more than 15 government webmail tenants. Employees who logged in triggered a WebSocket reporting flow, session-token harvesting, domain targeting and a fake “Adobe Flash update” prompt that led to a Windows backdoor and a persistent malicious browser extension.