2026-08-1315 mincritical

Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side

Jewelbug is a China-based APT group that operates government espionage and cryptocurrency fraud campaigns from a shared infrastructure and single control panel called XG-Web. The group uses a malicious browser extension named 'PDF Viewer' that bridges to the host via a native messaging host disguised as com.microsoft.runedge, the Antino backdoor which uses Microsoft Graph API for C2, and ClientKing, a Rust implant targeting Linux servers and routers. In its largest operation, Jewelbug injected a watering-hole script into a shared government webmail platform, compromising more than 15 tenants simultaneously and harvesting credentials, cookies, and email bodies from government officials.

Sens:■ Immediate

IOCs62

23sha25613domain12ip7url6filename1registry key

View list

Detection / Hunteropenrouter

What Happened

A group of hackers based in China, called Jewelbug, has been breaking into government computer systems across the Middle East and Asia while also running a separate cryptocurrency scam business. Both operations are managed from the same control panel. The attackers use malicious browser extensions and fake software updates to take control of victims' computers and steal their login credentials and browsing data. In one operation, they compromised a shared email platform used by a Middle Eastern government, giving them access to more than 15 government email systems at once. The group has collected over one million check-ins from infected computers and stolen more than 580,000 browser cookies. Organizations in government, defense, and cryptocurrency spaces should review their systems for the indicators described in this report and ensure browser extensions and native messaging hosts are properly monitored.

Key Takeaways

Jewelbug is a China-based hackers-for-hire group running parallel espionage and cryptocurrency fraud operations from a single control panel called XG-Web.
The group's primary implant is a malicious Chrome/Firefox extension named 'PDF Viewer' that requests broad browser permissions and bridges to the host via a native messaging host disguised as com.microsoft.runedge.
The Antino backdoor uses Microsoft Graph API as its C2 channel, hiding traffic inside legitimate Microsoft cloud services.
A single watering-hole script compromised more than 15 government webmail tenants in a Middle Eastern country by injecting a script tag into a shared webmail template.
The group's victim database recorded over one million implant check-ins and more than 580,000 stolen browser cookies in under three months.

Affected Systems

Windows endpoints
Linux servers (x86-64)
ARM64 devices
ASUS consumer routers
Chrome and Firefox browsers
Government webmail systems (shared hosting platforms)
Network infrastructure devices

Vulnerabilities (CVEs)

None identified.

Attack Chain

Initial Access: Watering-hole script tag injected into shared government webmail platform template, loading C2 JavaScript from fonts.chrorne.com on every login and mailbox page
Execution: Malicious JavaScript opens WebSocket to C2, completes cryptographic handshake, exfiltrates cookies and captures government email usernames for victim tagging
Defense Evasion: Fake Adobe Flash update prompt displayed only to targeted government domains running Windows, downloading Antino backdoor from group-controlled domains
Persistence: Antino writes registry key HKCU\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.microsoft.runedge to register native messaging host and sideloads 'PDF Viewer' browser extension into the victim's browser profile
C2: Antino beacons to Microsoft Graph API; browser extension connects to XG-Web panel via WebSocket with full browser API bridge and host command shell access through native messaging
Lateral Movement: Operators use browser foothold to reach internal infrastructure including virtualization-management clusters, authenticated internal services, and government network resources

Detection Availability

YARA Rules: No
Sigma Rules: No
Snort/Suricata Rules: No
KQL Queries: No
Splunk SPL Queries: No
EQL Queries: No
Other Detection Logic: No
Platforms: Symantec Endpoint products, Symantec Protection Bulletin, The Jewelbug Dossier whitepaper

The article references Symantec Endpoint products for file detection and blocking, and points to the Symantec Protection Bulletin and an accompanying whitepaper called 'The Jewelbug Dossier' for further protection guidance. No YARA, Sigma, Snort, Suricata, KQL, SPL, or EQL rules are provided in the article text.

Detection Engineering Assessment

Dimension	Rating	Rationale
EDR Visibility	Medium	EDR would capture Antino backdoor execution, registry modifications for native messaging host registration, and process creation from the command shell bridge. However, browser extension activity, WebSocket communications, and cookie exfiltration occur within the browser process and may not be fully instrumented by all EDR solutions.
Network Visibility	Medium	C2 traffic to Microsoft Graph API and Google Docs would appear as legitimate cloud service traffic and may not trigger network alerts. DNS tunneling used by ClientKing could be detected with DNS query analysis. WebSocket connections to typosquatted domains and direct IP connections are more likely to be flagged by network monitoring.
Detection Difficulty	Hard	The group uses legitimate cloud services (Microsoft Graph API, Google Docs) for C2, XOR-encoded payloads that produce unique downloads, typosquatted domains mimicking Google Fonts and Microsoft, and browser-based attacks that operate largely within the browser sandbox. The combination of cloud service abuse and browser extension tradecraft requires specialized telemetry that many organizations do not collect by default.

Required Log Sources

Browser extension installation and permission logs
Chrome/Firefox native messaging host registration events
Windows process creation logs (Sysmon Event ID 1, Security Event ID 4688)
Windows registry modification logs (Sysmon Event ID 13)
DNS query logs
HTTP/HTTPS proxy logs with TLS metadata
EDR process telemetry including command line arguments
Web server access logs for watering-hole detection

Hunting Hypotheses

Hypothesis	Telemetry	ATT&CK Stage	FP Risk
Consider hunting for browser extensions requesting combinations of debugger, nativeMessaging, cookies, and webRequest permissions, which together enable full browser hijacking and host command execution.	Browser extension management logs, Chrome/Firefox enterprise policy logs, EDR file system monitoring of browser profile directories	Persistence	Medium — some legitimate developer tools or security extensions may request subsets of these permissions, but the full combination is rare
Consider hunting for registry entries under NativeMessagingHosts keys that reference names mimicking Microsoft or Google components, particularly com.microsoft.runedge.	Sysmon Event ID 13 (registry value set), EDR registry monitoring, Group Policy registry auditing	Persistence	Low — legitimate native messaging hosts typically use vendor-consistent naming and are deployed through enterprise software management
Consider hunting for non-Microsoft processes making outbound connections to Microsoft Graph API endpoints, which may indicate Antino backdoor C2 activity.	EDR network connection telemetry, proxy logs with process attribution, Windows Firewall connection logs	Command and Control	Medium — legitimate applications and sync tools use Microsoft Graph API; correlation with process reputation and expected behavior is needed
Consider hunting for DNS query patterns consistent with DNS tunneling, particularly high-frequency TXT or CNAME queries to domains with randomized subdomains, which may indicate ClientKing C2 activity.	DNS query logs, passive DNS collection, network flow data	Command and Control	Low — DNS tunneling produces distinctive query volume and entropy patterns that are uncommon in normal enterprise traffic
Consider hunting for script tags injected into webmail or web application pages that reference external domains mimicking font or CDN services, which may indicate watering-hole compromise.	Web server access logs, WAF inspection logs, web application change monitoring, content security policy violation reports	Initial Access	Low — legitimate web applications rarely add script tags referencing unfamiliar external domains without documented change management

Control Gaps

Traditional signature-based AV may not detect browser extension-based attacks or recognize malicious extension permissions
Network security tools may not flag traffic to legitimate cloud services such as Microsoft Graph API and Google Docs used as C2 channels
DNS tunneling by ClientKing may bypass standard DNS filtering if query volume thresholds are not tuned for detection
Browser extension installation and permission grants are not typically monitored by EDR or SIEM in many organizations
Watering-hole script injection into shared hosting platforms may not be detected by endpoint controls since the compromise occurs server-side
XOR-encoded payloads with random keys produce unique file hashes on each download, defeating hash-based detection

Key Behavioral Indicators

Browser extension named 'PDF Viewer' requesting debugger, nativeMessaging, cookies, and webRequest permissions across all sites
Native messaging host registered as com.microsoft.runedge under Chrome NativeMessagingHosts registry path
Processes spawned by browser extensions executing Windows command interpreter commands
Non-Microsoft processes establishing connections to Microsoft Graph API endpoints
JavaScript fetched from Google Docs being executed by browser extensions or downloaded payloads
Script tags in webmail pages referencing domains that typosquat Google Fonts or Microsoft infrastructure
XOR-encoded payloads fetched from typosquatted CDN domains
Scheduled tasks checking domain reputation against VirusTotal every 12 hours
Browser extensions subscribing to cookie-change events for real-time session token theft

False Positive Assessment

Medium — Several indicators such as Microsoft Graph API traffic, Google Docs access, and browser extension installations are common in enterprise environments. File hashes, typosquatted domains, and the specific registry key for com.microsoft.runedge carry lower false positive risk. Behavioral indicators combining multiple signals (extension permissions, native messaging host registration, and non-standard process connections to cloud APIs) would reduce false positive rates significantly.

Recommendations

Immediate Mitigation

defender takeaway

Verify against your organization's incident response runbook and team escalation paths before acting. Consider searching endpoint and browser management logs for the file hashes, domains, and registry key listed in this report.
If your EDR supports it, consider searching for the registry path HKCU\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.microsoft.runedge across your fleet to identify compromised hosts.
Consider blocking the listed C2 domains and IPs at your firewall, proxy, and DNS filtering layers if consistent with your network security policies.
If browser extension management is available, consider auditing all installed extensions for those requesting debugger, nativeMessaging, cookies, and webRequest permissions simultaneously.
Consider reviewing proxy and DNS logs for connections to Microsoft Graph API from non-standard processes, and to Google Docs URLs fetched by automated processes or browser extensions.

Infrastructure Hardening

Consider implementing Content Security Policy headers on webmail and web application platforms to restrict inline script execution and external script loading.
Evaluate whether your web hosting platforms have file integrity monitoring for shared templates and configuration files to detect watering-hole script injection.
If applicable, consider deploying DNS tunneling detection rules that analyze query entropy, frequency, and TXT record usage patterns.
Consider implementing TLS inspection for traffic to Microsoft cloud services if your organization's risk model and privacy policies permit it, to detect non-standard process usage of Graph API.
Evaluate whether your network segmentation strategy would limit lateral movement from a compromised browser foothold to internal virtualization-management interfaces.

User Protection

Consider deploying browser extension management policies that block or require approval for extensions requesting nativeMessaging or debugger permissions.
If your organization uses Chrome or Firefox enterprise policies, consider restricting the NativeMessagingHosts registry path to approved extensions only.
Consider enabling browser features that warn users when extensions request broad permissions across all sites.
Evaluate whether your endpoint protection can monitor and alert on child processes spawned by browser processes, particularly cmd.exe or powershell.exe spawned from browser-native messaging hosts.

Security Awareness

Consider incorporating fake Adobe Flash update prompts into existing phishing awareness training, emphasizing that Flash is deprecated and any update prompt is malicious.
If applicable to your workforce, consider training users to verify browser extension names and permissions before installation, particularly extensions claiming to be PDF viewers.
Consider briefing webmail and web application administrators on the risk of shared template compromise and the importance of monitoring for unauthorized script tag injection.
If your organization operates in government or defense sectors, consider raising awareness about watering-hole attacks targeting shared hosting platforms and webmail providers.

MITRE ATT&CK Mapping

MITRE ATT&CK Mapping13 techniques

Tactic

Initial Access

T1189Drive-by Compromise T1566.002Spearphishing Link

Tactic

Execution

T1059.003Windows Command Shell

Tactic

Persistence

T1547.001Registry Run Keys / Startup Folder

Tactic

Stealth

T1027Obfuscated Files or Information

Tactic

Credential Access

T1555.003Credentials from Web Browsers

Tactic

Collection

T1185Browser Session Hijacking

Tactic

Command and Control

T1071.001Web Protocols T1071.004DNS T1105Ingress Tool Transfer T1572Protocol Tunneling T1573Encrypted Channel T1090.002External Proxy

Additional IOCs

Ips:
- 103[.]87[.]9[.]62 - C2 IP address associated with Jewelbug infrastructure
- 152[.]42[.]174[.]151 - C2 IP address associated with Jewelbug infrastructure
- 43[.]246[.]208[.]236 - C2 IP address associated with Jewelbug infrastructure
- 43[.]246[.]208[.]179 - C2 IP address associated with Jewelbug infrastructure
- 47[.]84[.]37[.]113 - C2 IP address associated with Jewelbug infrastructure
- 47[.]84[.]51[.]173 - C2 IP address associated with Jewelbug infrastructure
- 167[.]71[.]195[.]255 - C2 IP address associated with Jewelbug infrastructure
- 38[.]12[.]1[.]47 - C2 IP address associated with Jewelbug infrastructure
- 129[.]212[.]237[.]224 - C2 IP address associated with Jewelbug infrastructure
- 47[.]87[.]71[.]167 - C2 IP address associated with Jewelbug infrastructure
- 47[.]250[.]208[.]35 - C2 IP address associated with Jewelbug infrastructure
- 219[.]76[.]254[.]184 - C2 IP address associated with Jewelbug infrastructure
Domains:
- robot[.]avbliud[.]com - C2 domain associated with Jewelbug infrastructure
- www[.]wps-cn[.]com - C2 domain associated with Jewelbug infrastructure
- www[.]f1ash[.]org[.]cn - Typosquat domain hosting fake Adobe Flash installers for Chinese-speaking victims
- browser-update[.]pages[.]dev - C2 domain hosted on GitHub Pages infrastructure used by Jewelbug
- eastus2[.]wac-azure[.]com - Typosquat of Azure domain used for C2
- mailbycloud[.]com - C2 domain associated with Jewelbug infrastructure
- www[.]jkskhei[.]com - C2 domain associated with Jewelbug infrastructure
- ns1[.]jkskhei[.]com - Nameserver for Jewelbug C2 domain jkskhei.com
- dns[.]wizkidblogger[.]com - DNS infrastructure domain associated with Jewelbug
- r6fi2yvqql[.]execute-api[.]ap-southeast-2[.]amazonaws[.]com - AWS API Gateway endpoint used as C2 infrastructure by Jewelbug
Urls:
- hxxp://d2nq35tel3ucuo[.]cloudfront[.]net/LtVGUSsyUTDA.log - CloudFront URL used for C2 logging or data exfiltration
- hxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/hjgzBskgslc.dll.iwq - Cloudflare R2 URL hosting a malicious DLL payload
- hxxps://microsoft-flash[.]com/download/flashcenter_pp_ax_install_en.exe - Download URL for fake Adobe Flash installer delivering Antino backdoor
- hxxps://www[.]f1ash[.]org[.]cn/flashcenter_pp_ax_install_cn.exe - Download URL for Chinese-language fake Adobe Flash installer
- hxxp://fonts[.]tarotfree101[.]top/config/config_nsu56n7m.js - Configuration JavaScript file served from XG-Web panel domain
File Hashes:
- e6ff096a0562c0042b09d250bd60272ffcd8d72bd95c563842acf765a8dc8bcf (SHA256) - HTA lure document used for initial delivery
- 01b5c6acb20e41799a0e96d9d1d6e1c44791883706b6285e874fcb15cc93b31a (SHA256) - HTA downloader themed on Russia/Venezuela/Ukraine geopolitical events
- e809da86bd81463347fa7f922d3e088755a94a331889d32acb55aa8f57778a34 (SHA256) - HTA lure document used for initial delivery
- f1ef5fe4c0cdcff13cc750c867728b89719f81437bdc49041edd1ae1f3edb4e8 (SHA256) - HTA file named TEST.hta used during development or testing
- e2eb7703047b37b28dc34e6990205d758a2454b39bc655b460606745fadcb530 (SHA256) - DLL file named slc.dll associated with Jewelbug tooling
- e7e3b0bcd6798634adf8b49d305f3a7b7682e4b76db549682a183c5a186df4bb (SHA256) - DLL file named Vb0c44dfslc.dll.wxb associated with Jewelbug tooling
- c11714f9fe2df1ca906585c81498cd77f5ec05b132aab73fa3a71d71d71e42cc (SHA256) - Antino backdoor sample
- 9b7df409c9a89f7536d3ba7b6d43fb6dbac618c8bb52615ba34cc971ad71bbf3 (SHA256) - Fake Adobe installer named Adobe_installer (1).exe
- 153d077bcb58e00f5746573cba25f6b0788b809bf7b2a52fca0dc22d3bb5c94e (SHA256) - Antino-related sample observed on infected Middle Eastern host
- 297413a3e49e7353bf484a3eb15ec647de729211059df8fc68678d2378b6f561 (SHA256) - Antino-related sample observed on infected Middle Eastern host
- 30f5122cc199b9c2e524503b343a9ee13a6f9773dcbc1df82c8b25ad20bca61d (SHA256) - Antino-related sample observed on infected Middle Eastern host
- 430f12970f8d58f12edccee9019a1aa90fa232c961449bdcc69c8d348a52cf55 (SHA256) - Antino-related sample observed on infected Middle Eastern host
- 5ccdf53881f6c758af8d94fe67066af209b4bc0a3cb80b6a4c724fad86eb97ef (SHA256) - Antino-related sample observed on infected Middle Eastern host
- 5edb8d1023b8babf302871b68fa2b26d5ca57633f64951922998e8f1d6c8f7ac (SHA256) - Antino-related sample observed on infected Middle Eastern host
- 6d5fe6b6a34eeb470798b970b70f41a07ccf59b22f49ad9b3dfff7aa3256f3c2 (SHA256) - Antino-related sample observed on infected Middle Eastern host
- 97c3a6be1711c5340d8806e4a54f7297f3f763d0aa4240b667f1e4e1f98f2aad (SHA256) - Antino-related sample observed on infected Middle Eastern host
- ac3d453d3c9b0310ebb8a67cef35e2ac954d4acdf70cf497fe43a02c7a510813 (SHA256) - Antino-related sample observed on infected Middle Eastern host
- e782a6d4919f194d41e524ebd6df5894197043cf772fcf60455127b246f302c0 (SHA256) - Antino-related sample observed on infected Middle Eastern host
- ea893abf20b00d9bfc042a88fbf7b4bd42e68ce07c116d3e3b002e5b4a853877 (SHA256) - Antino-related sample observed on infected Middle Eastern host
- ed96e7f1085a50251eb8967ac53777272a617831084f0edad8a769c583a18869 (SHA256) - Antino-related sample observed on infected Middle Eastern host
File Paths:
- Adobeinstall.exe - Fake Adobe installer filename delivering Antino backdoor, downloaded from microsoft-flash.com
- TEST.hta - HTA file associated with Jewelbug tooling
- slc.dll - DLL file associated with Jewelbug tooling
- Vb0c44dfslc.dll.wxb - DLL file with obfuscated extension associated with Jewelbug tooling
- Adobe_installer (1).exe - Fake Adobe installer filename delivering Antino backdoor
Command Lines:
- Purpose: Inject watering-hole script tag into shared government webmail template to load C2 payload on every page view | Tools: JavaScript, WebSocket | Stage: Initial Access | <script src=
- Purpose: Register malicious native messaging host under misleading Microsoft Edge component name to enable command shell access from browser extension | Tools: Antino backdoor, reg.exe | Stage: Persistence | reg add HKCU\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.microsoft.runedge
Other:
- com.microsoft.runedge - Misleading native messaging host name disguised as Microsoft Edge component, used by the 'PDF Viewer' browser extension to execute operating system commands

IOCs · 62

.txt .json

domain
browser-update[.]pages[.]devC2 domain hosted on GitHub Pages infrastructure used by Jewelbug
domain
dns[.]wizkidblogger[.]comDNS infrastructure domain associated with Jewelbug
domain
eastus2[.]wac-azure[.]comTyposquat of Azure domain used for C2
domain
fonts[.]chrorne[.]comTyposquat of Google Fonts used as watering-hole C2 endpoint; script tag injected into government webmail templates
domain
fonts[.]tarotfree101[.]topDomain hosting the XG-Web control panel configuration and C2 infrastructure
domain
mailbycloud[.]comC2 domain associated with Jewelbug infrastructure
domain
microsoft-flash[.]comPrimary domain used to host fake Adobe Flash update downloads delivering the Antino backdoor
domain
ns1[.]jkskhei[.]comNameserver for Jewelbug C2 domain jkskhei.com
domain
r6fi2yvqql[.]execute-api[.]ap-southeast-2[.]amazonaws[.]comAWS API Gateway endpoint used as C2 infrastructure by Jewelbug
domain
robot[.]avbliud[.]comC2 domain associated with Jewelbug infrastructure
domain
www[.]f1ash[.]org[.]cnTyposquat domain hosting fake Adobe Flash installers for Chinese-speaking victims
domain
www[.]jkskhei[.]comC2 domain associated with Jewelbug infrastructure
domain
www[.]wps-cn[.]comC2 domain associated with Jewelbug infrastructure
filename
Adobe_installer1.exeFake Adobe installer filename delivering Antino backdoor
filename
Adobeinstall.exeFake Adobe installer filename delivering Antino backdoor, downloaded from microsoft-flash.com
filename
flashcenter_pp_ax_install_en.exeFake Adobe Flash installer filename used to deliver the Antino backdoor
filename
slc.dllDLL file associated with Jewelbug tooling
filename
TEST.htaHTA file associated with Jewelbug tooling
filename
Vb0c44dfslc.dll.wxbDLL file with obfuscated extension associated with Jewelbug tooling
ip
103[.]87[.]9[.]62C2 IP address associated with Jewelbug infrastructure
ip
129[.]212[.]237[.]224C2 IP address associated with Jewelbug infrastructure
ip
152[.]42[.]174[.]151C2 IP address associated with Jewelbug infrastructure
ip
167[.]71[.]195[.]255C2 IP address associated with Jewelbug infrastructure
ip
219[.]76[.]254[.]184C2 IP address associated with Jewelbug infrastructure
ip
38[.]12[.]1[.]47C2 IP address associated with Jewelbug infrastructure
ip
43[.]246[.]208[.]179C2 IP address associated with Jewelbug infrastructure
ip
43[.]246[.]208[.]236C2 IP address associated with Jewelbug infrastructure
ip
47[.]250[.]208[.]35C2 IP address associated with Jewelbug infrastructure
ip
47[.]84[.]37[.]113C2 IP address associated with Jewelbug infrastructure
ip
47[.]84[.]51[.]173C2 IP address associated with Jewelbug infrastructure
ip
47[.]87[.]71[.]167C2 IP address associated with Jewelbug infrastructure
registry_key
HKCU\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.microsoft.runedgeRegistry key written by Antino to register a malicious native messaging host disguised as a Microsoft Edge component, enabling command shell access from the browser extension
sha256
01b5c6acb20e41799a0e96d9d1d6e1c44791883706b6285e874fcb15cc93b31aHTA downloader themed on Russia/Venezuela/Ukraine geopolitical events
sha256
09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cffAntino backdoor sample, the group's primary Windows backdoor payload
sha256
0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bdAntino sample connecting to Microsoft Graph API for C2, downloaded from microsoft-flash.com
sha256
153d077bcb58e00f5746573cba25f6b0788b809bf7b2a52fca0dc22d3bb5c94eAntino-related sample observed on infected Middle Eastern host
sha256
297413a3e49e7353bf484a3eb15ec647de729211059df8fc68678d2378b6f561Antino-related sample observed on infected Middle Eastern host
sha256
30f5122cc199b9c2e524503b343a9ee13a6f9773dcbc1df82c8b25ad20bca61dAntino-related sample observed on infected Middle Eastern host
sha256
430f12970f8d58f12edccee9019a1aa90fa232c961449bdcc69c8d348a52cf55Antino-related sample observed on infected Middle Eastern host
sha256
5ccdf53881f6c758af8d94fe67066af209b4bc0a3cb80b6a4c724fad86eb97efAntino-related sample observed on infected Middle Eastern host
sha256
5edb8d1023b8babf302871b68fa2b26d5ca57633f64951922998e8f1d6c8f7acAntino-related sample observed on infected Middle Eastern host
sha256
6d5fe6b6a34eeb470798b970b70f41a07ccf59b22f49ad9b3dfff7aa3256f3c2Antino-related sample observed on infected Middle Eastern host
sha256
97c3a6be1711c5340d8806e4a54f7297f3f763d0aa4240b667f1e4e1f98f2aadAntino-related sample observed on infected Middle Eastern host
sha256
9b7df409c9a89f7536d3ba7b6d43fb6dbac618c8bb52615ba34cc971ad71bbf3Fake Adobe installer named Adobe_installer (1).exe
sha256
ac3d453d3c9b0310ebb8a67cef35e2ac954d4acdf70cf497fe43a02c7a510813Antino-related sample observed on infected Middle Eastern host
sha256
b90a4e770869c28fd2140acb3ebdc50c113bb6f096b4bbdb9ac87c349c70e85eFake Adobe Flash installer (flashcenter_pp_ax_install_en.exe) that delivers Antino backdoor
sha256
c11714f9fe2df1ca906585c81498cd77f5ec05b132aab73fa3a71d71d71e42ccAntino backdoor sample
sha256
e2eb7703047b37b28dc34e6990205d758a2454b39bc655b460606745fadcb530DLL file named slc.dll associated with Jewelbug tooling
sha256
e6ff096a0562c0042b09d250bd60272ffcd8d72bd95c563842acf765a8dc8bcfHTA lure document used for initial delivery
sha256
e782a6d4919f194d41e524ebd6df5894197043cf772fcf60455127b246f302c0Antino-related sample observed on infected Middle Eastern host
sha256
e7e3b0bcd6798634adf8b49d305f3a7b7682e4b76db549682a183c5a186df4bbDLL file named Vb0c44dfslc.dll.wxb associated with Jewelbug tooling
sha256
e809da86bd81463347fa7f922d3e088755a94a331889d32acb55aa8f57778a34HTA lure document used for initial delivery
sha256
ea893abf20b00d9bfc042a88fbf7b4bd42e68ce07c116d3e3b002e5b4a853877Antino-related sample observed on infected Middle Eastern host
sha256
ed96e7f1085a50251eb8967ac53777272a617831084f0edad8a769c583a18869Antino-related sample observed on infected Middle Eastern host
sha256
f1ef5fe4c0cdcff13cc750c867728b89719f81437bdc49041edd1ae1f3edb4e8HTA file named TEST.hta used during development or testing
url
hxxp://d2nq35tel3ucuo[.]cloudfront[.]net/LtVGUSsyUTDA[.]logCloudFront URL used for C2 logging or data exfiltration
url
hxxp://fonts[.]tarotfree101[.]top/config/config_nsu56n7m[.]jsConfiguration JavaScript file served from XG-Web panel domain
url
hxxps://fonts[.]chrorne[.]com/dist/js/12[.]qgfvjzvs[.]chunk[.]jsWatering-hole JavaScript payload injected as a script tag into shared government webmail templates
url
hxxps://microsoft-flash[.]com/download/Adobeinstall[.]exeDirect download URL for Antino backdoor delivered via fake Adobe Flash update prompt on compromised government webmail
url
hxxps://microsoft-flash[.]com/download/flashcenter_pp_ax_install_en[.]exeDownload URL for fake Adobe Flash installer delivering Antino backdoor
url
hxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/hjgzBskgslc[.]dll[.]iwqCloudflare R2 URL hosting a malicious DLL payload
url
hxxps://www[.]f1ash[.]org[.]cn/flashcenter_pp_ax_install_cn[.]exeDownload URL for Chinese-language fake Adobe Flash installer

Stay currentSubscribe via RSS

2026-08-1315 mincritical

Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side

Sens:■ Immediate

IOCs62

23sha25613domain12ip7url6filename1registry key

View list

Detection / Hunteropenrouter

What Happened

Key Takeaways

Jewelbug is a China-based hackers-for-hire group running parallel espionage and cryptocurrency fraud operations from a single control panel called XG-Web.
The group's primary implant is a malicious Chrome/Firefox extension named 'PDF Viewer' that requests broad browser permissions and bridges to the host via a native messaging host disguised as com.microsoft.runedge.
The Antino backdoor uses Microsoft Graph API as its C2 channel, hiding traffic inside legitimate Microsoft cloud services.
A single watering-hole script compromised more than 15 government webmail tenants in a Middle Eastern country by injecting a script tag into a shared webmail template.
The group's victim database recorded over one million implant check-ins and more than 580,000 stolen browser cookies in under three months.

Affected Systems

Windows endpoints
Linux servers (x86-64)
ARM64 devices
ASUS consumer routers
Chrome and Firefox browsers
Government webmail systems (shared hosting platforms)
Network infrastructure devices

Vulnerabilities (CVEs)

None identified.

Attack Chain

Initial Access: Watering-hole script tag injected into shared government webmail platform template, loading C2 JavaScript from fonts.chrorne.com on every login and mailbox page
Execution: Malicious JavaScript opens WebSocket to C2, completes cryptographic handshake, exfiltrates cookies and captures government email usernames for victim tagging
Defense Evasion: Fake Adobe Flash update prompt displayed only to targeted government domains running Windows, downloading Antino backdoor from group-controlled domains
Persistence: Antino writes registry key HKCU\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.microsoft.runedge to register native messaging host and sideloads 'PDF Viewer' browser extension into the victim's browser profile
C2: Antino beacons to Microsoft Graph API; browser extension connects to XG-Web panel via WebSocket with full browser API bridge and host command shell access through native messaging
Lateral Movement: Operators use browser foothold to reach internal infrastructure including virtualization-management clusters, authenticated internal services, and government network resources

Detection Availability

YARA Rules: No
Sigma Rules: No
Snort/Suricata Rules: No
KQL Queries: No
Splunk SPL Queries: No
EQL Queries: No
Other Detection Logic: No
Platforms: Symantec Endpoint products, Symantec Protection Bulletin, The Jewelbug Dossier whitepaper

The article references Symantec Endpoint products for file detection and blocking, and points to the Symantec Protection Bulletin and an accompanying whitepaper called 'The Jewelbug Dossier' for further protection guidance. No YARA, Sigma, Snort, Suricata, KQL, SPL, or EQL rules are provided in the article text.

Detection Engineering Assessment

Dimension	Rating	Rationale
EDR Visibility	Medium	EDR would capture Antino backdoor execution, registry modifications for native messaging host registration, and process creation from the command shell bridge. However, browser extension activity, WebSocket communications, and cookie exfiltration occur within the browser process and may not be fully instrumented by all EDR solutions.
Network Visibility	Medium	C2 traffic to Microsoft Graph API and Google Docs would appear as legitimate cloud service traffic and may not trigger network alerts. DNS tunneling used by ClientKing could be detected with DNS query analysis. WebSocket connections to typosquatted domains and direct IP connections are more likely to be flagged by network monitoring.
Detection Difficulty	Hard	The group uses legitimate cloud services (Microsoft Graph API, Google Docs) for C2, XOR-encoded payloads that produce unique downloads, typosquatted domains mimicking Google Fonts and Microsoft, and browser-based attacks that operate largely within the browser sandbox. The combination of cloud service abuse and browser extension tradecraft requires specialized telemetry that many organizations do not collect by default.

Required Log Sources

Browser extension installation and permission logs
Chrome/Firefox native messaging host registration events
Windows process creation logs (Sysmon Event ID 1, Security Event ID 4688)
Windows registry modification logs (Sysmon Event ID 13)
DNS query logs
HTTP/HTTPS proxy logs with TLS metadata
EDR process telemetry including command line arguments
Web server access logs for watering-hole detection

Hunting Hypotheses

Hypothesis	Telemetry	ATT&CK Stage	FP Risk
Consider hunting for browser extensions requesting combinations of debugger, nativeMessaging, cookies, and webRequest permissions, which together enable full browser hijacking and host command execution.	Browser extension management logs, Chrome/Firefox enterprise policy logs, EDR file system monitoring of browser profile directories	Persistence	Medium — some legitimate developer tools or security extensions may request subsets of these permissions, but the full combination is rare
Consider hunting for registry entries under NativeMessagingHosts keys that reference names mimicking Microsoft or Google components, particularly com.microsoft.runedge.	Sysmon Event ID 13 (registry value set), EDR registry monitoring, Group Policy registry auditing	Persistence	Low — legitimate native messaging hosts typically use vendor-consistent naming and are deployed through enterprise software management
Consider hunting for non-Microsoft processes making outbound connections to Microsoft Graph API endpoints, which may indicate Antino backdoor C2 activity.	EDR network connection telemetry, proxy logs with process attribution, Windows Firewall connection logs	Command and Control	Medium — legitimate applications and sync tools use Microsoft Graph API; correlation with process reputation and expected behavior is needed
Consider hunting for DNS query patterns consistent with DNS tunneling, particularly high-frequency TXT or CNAME queries to domains with randomized subdomains, which may indicate ClientKing C2 activity.	DNS query logs, passive DNS collection, network flow data	Command and Control	Low — DNS tunneling produces distinctive query volume and entropy patterns that are uncommon in normal enterprise traffic
Consider hunting for script tags injected into webmail or web application pages that reference external domains mimicking font or CDN services, which may indicate watering-hole compromise.	Web server access logs, WAF inspection logs, web application change monitoring, content security policy violation reports	Initial Access	Low — legitimate web applications rarely add script tags referencing unfamiliar external domains without documented change management

Control Gaps

Traditional signature-based AV may not detect browser extension-based attacks or recognize malicious extension permissions
Network security tools may not flag traffic to legitimate cloud services such as Microsoft Graph API and Google Docs used as C2 channels
DNS tunneling by ClientKing may bypass standard DNS filtering if query volume thresholds are not tuned for detection
Browser extension installation and permission grants are not typically monitored by EDR or SIEM in many organizations
Watering-hole script injection into shared hosting platforms may not be detected by endpoint controls since the compromise occurs server-side
XOR-encoded payloads with random keys produce unique file hashes on each download, defeating hash-based detection

Key Behavioral Indicators

Browser extension named 'PDF Viewer' requesting debugger, nativeMessaging, cookies, and webRequest permissions across all sites
Native messaging host registered as com.microsoft.runedge under Chrome NativeMessagingHosts registry path
Processes spawned by browser extensions executing Windows command interpreter commands
Non-Microsoft processes establishing connections to Microsoft Graph API endpoints
JavaScript fetched from Google Docs being executed by browser extensions or downloaded payloads
Script tags in webmail pages referencing domains that typosquat Google Fonts or Microsoft infrastructure
XOR-encoded payloads fetched from typosquatted CDN domains
Scheduled tasks checking domain reputation against VirusTotal every 12 hours
Browser extensions subscribing to cookie-change events for real-time session token theft

False Positive Assessment

Recommendations

Immediate Mitigation

defender takeaway

Verify against your organization's incident response runbook and team escalation paths before acting. Consider searching endpoint and browser management logs for the file hashes, domains, and registry key listed in this report.
If your EDR supports it, consider searching for the registry path HKCU\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.microsoft.runedge across your fleet to identify compromised hosts.
Consider blocking the listed C2 domains and IPs at your firewall, proxy, and DNS filtering layers if consistent with your network security policies.
If browser extension management is available, consider auditing all installed extensions for those requesting debugger, nativeMessaging, cookies, and webRequest permissions simultaneously.
Consider reviewing proxy and DNS logs for connections to Microsoft Graph API from non-standard processes, and to Google Docs URLs fetched by automated processes or browser extensions.

Infrastructure Hardening

Consider implementing Content Security Policy headers on webmail and web application platforms to restrict inline script execution and external script loading.
Evaluate whether your web hosting platforms have file integrity monitoring for shared templates and configuration files to detect watering-hole script injection.
If applicable, consider deploying DNS tunneling detection rules that analyze query entropy, frequency, and TXT record usage patterns.
Consider implementing TLS inspection for traffic to Microsoft cloud services if your organization's risk model and privacy policies permit it, to detect non-standard process usage of Graph API.
Evaluate whether your network segmentation strategy would limit lateral movement from a compromised browser foothold to internal virtualization-management interfaces.

User Protection

Consider deploying browser extension management policies that block or require approval for extensions requesting nativeMessaging or debugger permissions.
If your organization uses Chrome or Firefox enterprise policies, consider restricting the NativeMessagingHosts registry path to approved extensions only.
Consider enabling browser features that warn users when extensions request broad permissions across all sites.
Evaluate whether your endpoint protection can monitor and alert on child processes spawned by browser processes, particularly cmd.exe or powershell.exe spawned from browser-native messaging hosts.

Security Awareness

Consider incorporating fake Adobe Flash update prompts into existing phishing awareness training, emphasizing that Flash is deprecated and any update prompt is malicious.
If applicable to your workforce, consider training users to verify browser extension names and permissions before installation, particularly extensions claiming to be PDF viewers.
Consider briefing webmail and web application administrators on the risk of shared template compromise and the importance of monitoring for unauthorized script tag injection.
If your organization operates in government or defense sectors, consider raising awareness about watering-hole attacks targeting shared hosting platforms and webmail providers.

MITRE ATT&CK Mapping

MITRE ATT&CK Mapping13 techniques

Tactic

Initial Access

T1189Drive-by Compromise T1566.002Spearphishing Link

Tactic

Execution

T1059.003Windows Command Shell

Tactic

Persistence

T1547.001Registry Run Keys / Startup Folder

Tactic

Stealth

T1027Obfuscated Files or Information

Tactic

Credential Access

T1555.003Credentials from Web Browsers

Tactic

Collection

T1185Browser Session Hijacking

Tactic

Command and Control

T1071.001Web Protocols T1071.004DNS T1105Ingress Tool Transfer T1572Protocol Tunneling T1573Encrypted Channel T1090.002External Proxy

Additional IOCs

Ips:
- 103[.]87[.]9[.]62 - C2 IP address associated with Jewelbug infrastructure
- 152[.]42[.]174[.]151 - C2 IP address associated with Jewelbug infrastructure
- 43[.]246[.]208[.]236 - C2 IP address associated with Jewelbug infrastructure
- 43[.]246[.]208[.]179 - C2 IP address associated with Jewelbug infrastructure
- 47[.]84[.]37[.]113 - C2 IP address associated with Jewelbug infrastructure
- 47[.]84[.]51[.]173 - C2 IP address associated with Jewelbug infrastructure
- 167[.]71[.]195[.]255 - C2 IP address associated with Jewelbug infrastructure
- 38[.]12[.]1[.]47 - C2 IP address associated with Jewelbug infrastructure
- 129[.]212[.]237[.]224 - C2 IP address associated with Jewelbug infrastructure
- 47[.]87[.]71[.]167 - C2 IP address associated with Jewelbug infrastructure
- 47[.]250[.]208[.]35 - C2 IP address associated with Jewelbug infrastructure
- 219[.]76[.]254[.]184 - C2 IP address associated with Jewelbug infrastructure
Domains:
- robot[.]avbliud[.]com - C2 domain associated with Jewelbug infrastructure
- www[.]wps-cn[.]com - C2 domain associated with Jewelbug infrastructure
- www[.]f1ash[.]org[.]cn - Typosquat domain hosting fake Adobe Flash installers for Chinese-speaking victims
- browser-update[.]pages[.]dev - C2 domain hosted on GitHub Pages infrastructure used by Jewelbug
- eastus2[.]wac-azure[.]com - Typosquat of Azure domain used for C2
- mailbycloud[.]com - C2 domain associated with Jewelbug infrastructure
- www[.]jkskhei[.]com - C2 domain associated with Jewelbug infrastructure
- ns1[.]jkskhei[.]com - Nameserver for Jewelbug C2 domain jkskhei.com
- dns[.]wizkidblogger[.]com - DNS infrastructure domain associated with Jewelbug
- r6fi2yvqql[.]execute-api[.]ap-southeast-2[.]amazonaws[.]com - AWS API Gateway endpoint used as C2 infrastructure by Jewelbug
Urls:
- hxxp://d2nq35tel3ucuo[.]cloudfront[.]net/LtVGUSsyUTDA.log - CloudFront URL used for C2 logging or data exfiltration
- hxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/hjgzBskgslc.dll.iwq - Cloudflare R2 URL hosting a malicious DLL payload
- hxxps://microsoft-flash[.]com/download/flashcenter_pp_ax_install_en.exe - Download URL for fake Adobe Flash installer delivering Antino backdoor
- hxxps://www[.]f1ash[.]org[.]cn/flashcenter_pp_ax_install_cn.exe - Download URL for Chinese-language fake Adobe Flash installer
- hxxp://fonts[.]tarotfree101[.]top/config/config_nsu56n7m.js - Configuration JavaScript file served from XG-Web panel domain
File Hashes:
- e6ff096a0562c0042b09d250bd60272ffcd8d72bd95c563842acf765a8dc8bcf (SHA256) - HTA lure document used for initial delivery
- 01b5c6acb20e41799a0e96d9d1d6e1c44791883706b6285e874fcb15cc93b31a (SHA256) - HTA downloader themed on Russia/Venezuela/Ukraine geopolitical events
- e809da86bd81463347fa7f922d3e088755a94a331889d32acb55aa8f57778a34 (SHA256) - HTA lure document used for initial delivery
- f1ef5fe4c0cdcff13cc750c867728b89719f81437bdc49041edd1ae1f3edb4e8 (SHA256) - HTA file named TEST.hta used during development or testing
- e2eb7703047b37b28dc34e6990205d758a2454b39bc655b460606745fadcb530 (SHA256) - DLL file named slc.dll associated with Jewelbug tooling
- e7e3b0bcd6798634adf8b49d305f3a7b7682e4b76db549682a183c5a186df4bb (SHA256) - DLL file named Vb0c44dfslc.dll.wxb associated with Jewelbug tooling
- c11714f9fe2df1ca906585c81498cd77f5ec05b132aab73fa3a71d71d71e42cc (SHA256) - Antino backdoor sample
- 9b7df409c9a89f7536d3ba7b6d43fb6dbac618c8bb52615ba34cc971ad71bbf3 (SHA256) - Fake Adobe installer named Adobe_installer (1).exe
- 153d077bcb58e00f5746573cba25f6b0788b809bf7b2a52fca0dc22d3bb5c94e (SHA256) - Antino-related sample observed on infected Middle Eastern host
- 297413a3e49e7353bf484a3eb15ec647de729211059df8fc68678d2378b6f561 (SHA256) - Antino-related sample observed on infected Middle Eastern host
- 30f5122cc199b9c2e524503b343a9ee13a6f9773dcbc1df82c8b25ad20bca61d (SHA256) - Antino-related sample observed on infected Middle Eastern host
- 430f12970f8d58f12edccee9019a1aa90fa232c961449bdcc69c8d348a52cf55 (SHA256) - Antino-related sample observed on infected Middle Eastern host
- 5ccdf53881f6c758af8d94fe67066af209b4bc0a3cb80b6a4c724fad86eb97ef (SHA256) - Antino-related sample observed on infected Middle Eastern host
- 5edb8d1023b8babf302871b68fa2b26d5ca57633f64951922998e8f1d6c8f7ac (SHA256) - Antino-related sample observed on infected Middle Eastern host
- 6d5fe6b6a34eeb470798b970b70f41a07ccf59b22f49ad9b3dfff7aa3256f3c2 (SHA256) - Antino-related sample observed on infected Middle Eastern host
- 97c3a6be1711c5340d8806e4a54f7297f3f763d0aa4240b667f1e4e1f98f2aad (SHA256) - Antino-related sample observed on infected Middle Eastern host
- ac3d453d3c9b0310ebb8a67cef35e2ac954d4acdf70cf497fe43a02c7a510813 (SHA256) - Antino-related sample observed on infected Middle Eastern host
- e782a6d4919f194d41e524ebd6df5894197043cf772fcf60455127b246f302c0 (SHA256) - Antino-related sample observed on infected Middle Eastern host
- ea893abf20b00d9bfc042a88fbf7b4bd42e68ce07c116d3e3b002e5b4a853877 (SHA256) - Antino-related sample observed on infected Middle Eastern host
- ed96e7f1085a50251eb8967ac53777272a617831084f0edad8a769c583a18869 (SHA256) - Antino-related sample observed on infected Middle Eastern host
File Paths:
- Adobeinstall.exe - Fake Adobe installer filename delivering Antino backdoor, downloaded from microsoft-flash.com
- TEST.hta - HTA file associated with Jewelbug tooling
- slc.dll - DLL file associated with Jewelbug tooling
- Vb0c44dfslc.dll.wxb - DLL file with obfuscated extension associated with Jewelbug tooling
- Adobe_installer (1).exe - Fake Adobe installer filename delivering Antino backdoor
Command Lines:
- Purpose: Inject watering-hole script tag into shared government webmail template to load C2 payload on every page view | Tools: JavaScript, WebSocket | Stage: Initial Access | <script src=
- Purpose: Register malicious native messaging host under misleading Microsoft Edge component name to enable command shell access from browser extension | Tools: Antino backdoor, reg.exe | Stage: Persistence | reg add HKCU\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.microsoft.runedge
Other:
- com.microsoft.runedge - Misleading native messaging host name disguised as Microsoft Edge component, used by the 'PDF Viewer' browser extension to execute operating system commands

IOCs · 62

.txt .json

domain
browser-update[.]pages[.]devC2 domain hosted on GitHub Pages infrastructure used by Jewelbug
domain
dns[.]wizkidblogger[.]comDNS infrastructure domain associated with Jewelbug
domain
eastus2[.]wac-azure[.]comTyposquat of Azure domain used for C2
domain
fonts[.]chrorne[.]comTyposquat of Google Fonts used as watering-hole C2 endpoint; script tag injected into government webmail templates
domain
fonts[.]tarotfree101[.]topDomain hosting the XG-Web control panel configuration and C2 infrastructure
domain
mailbycloud[.]comC2 domain associated with Jewelbug infrastructure
domain
microsoft-flash[.]comPrimary domain used to host fake Adobe Flash update downloads delivering the Antino backdoor
domain
ns1[.]jkskhei[.]comNameserver for Jewelbug C2 domain jkskhei.com
domain
r6fi2yvqql[.]execute-api[.]ap-southeast-2[.]amazonaws[.]comAWS API Gateway endpoint used as C2 infrastructure by Jewelbug
domain
robot[.]avbliud[.]comC2 domain associated with Jewelbug infrastructure
domain
www[.]f1ash[.]org[.]cnTyposquat domain hosting fake Adobe Flash installers for Chinese-speaking victims
domain
www[.]jkskhei[.]comC2 domain associated with Jewelbug infrastructure
domain
www[.]wps-cn[.]comC2 domain associated with Jewelbug infrastructure
filename
Adobe_installer1.exeFake Adobe installer filename delivering Antino backdoor
filename
Adobeinstall.exeFake Adobe installer filename delivering Antino backdoor, downloaded from microsoft-flash.com
filename
flashcenter_pp_ax_install_en.exeFake Adobe Flash installer filename used to deliver the Antino backdoor
filename
slc.dllDLL file associated with Jewelbug tooling
filename
TEST.htaHTA file associated with Jewelbug tooling
filename
Vb0c44dfslc.dll.wxbDLL file with obfuscated extension associated with Jewelbug tooling
ip
103[.]87[.]9[.]62C2 IP address associated with Jewelbug infrastructure
ip
129[.]212[.]237[.]224C2 IP address associated with Jewelbug infrastructure
ip
152[.]42[.]174[.]151C2 IP address associated with Jewelbug infrastructure
ip
167[.]71[.]195[.]255C2 IP address associated with Jewelbug infrastructure
ip
219[.]76[.]254[.]184C2 IP address associated with Jewelbug infrastructure
ip
38[.]12[.]1[.]47C2 IP address associated with Jewelbug infrastructure
ip
43[.]246[.]208[.]179C2 IP address associated with Jewelbug infrastructure
ip
43[.]246[.]208[.]236C2 IP address associated with Jewelbug infrastructure
ip
47[.]250[.]208[.]35C2 IP address associated with Jewelbug infrastructure
ip
47[.]84[.]37[.]113C2 IP address associated with Jewelbug infrastructure
ip
47[.]84[.]51[.]173C2 IP address associated with Jewelbug infrastructure
ip
47[.]87[.]71[.]167C2 IP address associated with Jewelbug infrastructure
registry_key
HKCU\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.microsoft.runedgeRegistry key written by Antino to register a malicious native messaging host disguised as a Microsoft Edge component, enabling command shell access from the browser extension
sha256
01b5c6acb20e41799a0e96d9d1d6e1c44791883706b6285e874fcb15cc93b31aHTA downloader themed on Russia/Venezuela/Ukraine geopolitical events
sha256
09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cffAntino backdoor sample, the group's primary Windows backdoor payload
sha256
0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bdAntino sample connecting to Microsoft Graph API for C2, downloaded from microsoft-flash.com
sha256
153d077bcb58e00f5746573cba25f6b0788b809bf7b2a52fca0dc22d3bb5c94eAntino-related sample observed on infected Middle Eastern host
sha256
297413a3e49e7353bf484a3eb15ec647de729211059df8fc68678d2378b6f561Antino-related sample observed on infected Middle Eastern host
sha256
30f5122cc199b9c2e524503b343a9ee13a6f9773dcbc1df82c8b25ad20bca61dAntino-related sample observed on infected Middle Eastern host
sha256
430f12970f8d58f12edccee9019a1aa90fa232c961449bdcc69c8d348a52cf55Antino-related sample observed on infected Middle Eastern host
sha256
5ccdf53881f6c758af8d94fe67066af209b4bc0a3cb80b6a4c724fad86eb97efAntino-related sample observed on infected Middle Eastern host
sha256
5edb8d1023b8babf302871b68fa2b26d5ca57633f64951922998e8f1d6c8f7acAntino-related sample observed on infected Middle Eastern host
sha256
6d5fe6b6a34eeb470798b970b70f41a07ccf59b22f49ad9b3dfff7aa3256f3c2Antino-related sample observed on infected Middle Eastern host
sha256
97c3a6be1711c5340d8806e4a54f7297f3f763d0aa4240b667f1e4e1f98f2aadAntino-related sample observed on infected Middle Eastern host
sha256
9b7df409c9a89f7536d3ba7b6d43fb6dbac618c8bb52615ba34cc971ad71bbf3Fake Adobe installer named Adobe_installer (1).exe
sha256
ac3d453d3c9b0310ebb8a67cef35e2ac954d4acdf70cf497fe43a02c7a510813Antino-related sample observed on infected Middle Eastern host
sha256
b90a4e770869c28fd2140acb3ebdc50c113bb6f096b4bbdb9ac87c349c70e85eFake Adobe Flash installer (flashcenter_pp_ax_install_en.exe) that delivers Antino backdoor
sha256
c11714f9fe2df1ca906585c81498cd77f5ec05b132aab73fa3a71d71d71e42ccAntino backdoor sample
sha256
e2eb7703047b37b28dc34e6990205d758a2454b39bc655b460606745fadcb530DLL file named slc.dll associated with Jewelbug tooling
sha256
e6ff096a0562c0042b09d250bd60272ffcd8d72bd95c563842acf765a8dc8bcfHTA lure document used for initial delivery
sha256
e782a6d4919f194d41e524ebd6df5894197043cf772fcf60455127b246f302c0Antino-related sample observed on infected Middle Eastern host
sha256
e7e3b0bcd6798634adf8b49d305f3a7b7682e4b76db549682a183c5a186df4bbDLL file named Vb0c44dfslc.dll.wxb associated with Jewelbug tooling
sha256
e809da86bd81463347fa7f922d3e088755a94a331889d32acb55aa8f57778a34HTA lure document used for initial delivery
sha256
ea893abf20b00d9bfc042a88fbf7b4bd42e68ce07c116d3e3b002e5b4a853877Antino-related sample observed on infected Middle Eastern host
sha256
ed96e7f1085a50251eb8967ac53777272a617831084f0edad8a769c583a18869Antino-related sample observed on infected Middle Eastern host
sha256
f1ef5fe4c0cdcff13cc750c867728b89719f81437bdc49041edd1ae1f3edb4e8HTA file named TEST.hta used during development or testing
url
hxxp://d2nq35tel3ucuo[.]cloudfront[.]net/LtVGUSsyUTDA[.]logCloudFront URL used for C2 logging or data exfiltration
url
hxxp://fonts[.]tarotfree101[.]top/config/config_nsu56n7m[.]jsConfiguration JavaScript file served from XG-Web panel domain
url
hxxps://fonts[.]chrorne[.]com/dist/js/12[.]qgfvjzvs[.]chunk[.]jsWatering-hole JavaScript payload injected as a script tag into shared government webmail templates
url
hxxps://microsoft-flash[.]com/download/Adobeinstall[.]exeDirect download URL for Antino backdoor delivered via fake Adobe Flash update prompt on compromised government webmail
url
hxxps://microsoft-flash[.]com/download/flashcenter_pp_ax_install_en[.]exeDownload URL for fake Adobe Flash installer delivering Antino backdoor
url
hxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/hjgzBskgslc[.]dll[.]iwqCloudflare R2 URL hosting a malicious DLL payload
url
hxxps://www[.]f1ash[.]org[.]cn/flashcenter_pp_ax_install_cn[.]exeDownload URL for Chinese-language fake Adobe Flash installer

Stay currentSubscribe via RSS

What Happened

Key Takeaways

Affected Systems

Vulnerabilities (CVEs)

Attack Chain

Detection Availability

Detection Engineering Assessment

Required Log Sources

Hunting Hypotheses

Control Gaps

Key Behavioral Indicators

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

User Protection

Security Awareness

MITRE ATT&CK Mapping

Initial Access

Execution

Persistence

Stealth

Credential Access

Collection

Command and Control

Additional IOCs

Related

What Happened

Key Takeaways

Affected Systems

Vulnerabilities (CVEs)

Attack Chain

Detection Availability

Detection Engineering Assessment

Required Log Sources

Hunting Hypotheses

Control Gaps

Key Behavioral Indicators

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

User Protection

Security Awareness

MITRE ATT&CK Mapping

Initial Access

Execution

Persistence

Stealth

Credential Access

Collection

Command and Control

Additional IOCs

Related