Jewelbug Targets the Middle East and Asia via Cyber Espionage and Crypto Fraud Campaigns
Symantec’s Threat Hunter Team reported on Security.com¹ about Jewelbug, a China-based hackers-for-hire group. It runs two operations side by side: espionage against governments and militaries across the Middle East and Asia, and a for-profit cryptocurrency fraud business. Both are administered from a single control panel. In under three months of active operations, the group’s victim database logged more than a million implant check-ins and over 580,000 stolen browser cookies.
The original analysis publicized 27 network IoCs. Aided by the WhoisXML API MCP Server², we extracted the unique apex domains from the subdomain IoCs and checked which belonged to legitimate providers, leaving 32 IoCs—10 subdomains, 10 domains, and 12 IP addresses—for our DNS deep dive.
Original IoCs Analyzed
Domain and IP indicators from the reported campaign
Key Findings
Email-connected domains
Additional IP addresses
IP-connected domains
Malicious artifacts
These are key highlights from our analysis. The full report contains many more findings and detailed insights.
OUR RESEARCH PROCESS
- Subdomain and domain IoC legitimacy check
- Domain IoC WHOIS and DNS history analysis
- IP IoC geolocation and traffic analysis
- Email-connected domain discovery
- IP- and string-connected domain discovery
- Malicious artifact confirmation
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://cloud.google.com/blog/topics/threat-intelligence/distinct-clusters-target-individuals-of-interest-to-russia
- [2] https://main.whoisxmlapi.com/ai/mcp-server
Latest Reports
DNS Spotlight: BigBear 2.0 PhaaS Targets Span 40+ Countries
WhoisXML API uncovered 1,600+ additional artifacts linked to BigBear 2.0. Download the threat research materials now.
A DNS Investigation of the ASCII Smuggling Phishing Campaign
WhoisXML API uncovered 100+ additional artifacts linked to the ASCII smuggling phishing campaign. Download the threat research materials now.
A DNS Deep Dive into a Silver Fox-Style Fake Installer Campaign
WhoisXML API uncovered 1,500+ additional artifacts linked to a Silver Fox-style fake installer campaign. Download the threat research materials now.