Jewelbug — XG-Web Dual Espionage & Crypto-Fraud Platform
Executive Summary
On 2026-08-13, Broadcom's Symantec and Carbon Black Threat Hunter Team disclosed Jewelbug — a China-based group also tracked as Ink Dragon (Check Point), Earth Alux (Trend Micro), REF7707 (Elastic Security Labs, sometimes rendered REF770), and CL-STA-0049 (Palo Alto Networks Unit 42) — running two parallel businesses from one shared control panel: state-directed cyberespionage against government, military and telecom targets across the Middle East, Southeast Asia and South Asia, and an industrial-scale cryptocurrency-fraud operation impersonating OKX and Binance. The panel, XG-Web, is described by the vendor as "a browser-centric remote-access and information-stealing framework that turns a victim's browser into a full remote-control channel and reaches from there into the host and the internal network behind it" — a React front end on a Node.js backend, backed by a MySQL database that also serves as the implant rendezvous point.
The toolset spans three custom implants. Antino is a Windows backdoor delivered via geopolitically-themed HTA downloaders and fake Adobe Flash/installer lures, which sideloads a malicious "PDF Viewer" browser extension into the victim's Chrome/Firefox profile and registers a native-messaging bridge (com.microsoft.runedge) that hands the extension command-shell access to the host. The extension itself requests cookie, debugger, native-messaging and all-sites scripting permissions — enough to steal credentials, session cookies, browsing history and clipboard content, and it ships a dormant cryptocurrency-address-swap module. On Linux servers, ARM64 devices and consumer routers (ASUS observed), ClientKing is a Rust implant with five C2 transport channels including DNS tunneling, SOCKS pivoting, in-memory kernel-module loading, and a malicious su/sudo authentication module for credential theft.
The group's largest documented operation compromised a shared web-hosting platform run by a state telecom provider, gained write access, and injected a single malicious script into the webmail installation's common template — placing a simultaneous watering hole across 15+ government webmail tenants in one Middle Eastern country, exfiltrating session cookies via WebSocket and serving fake Adobe Flash update prompts to visiting staff. Across less than three months of observed operation, the vendor's analysis of the XG-Web victim database found 1M+ implant check-in rows, 580,000+ stolen browser cookies, several thousand captured credentials, and 2,300+ exfiltrated email bodies. The financial arm — tied to a company registered in Hunan Province, China advertising "search-ranking rental" on Telegram under the handle paopaodada ("Bubble Boss") — runs a 40-plus-server SEO-poisoning and click-fraud pipeline pushing AI-generated fake exchange pages under hundreds of OKX/Binance lookalike domains.
Defender priority: This pack ships no atomic hashes, domains or IPs — the fetched vendor and press coverage disclosed the operational architecture and scale in detail but did not publish an indicator list at the time of this build (see Source Review). Prioritize the four behavioral queries with the lowest false-positive ceilings: Q1/Q2 (Antino's fake-Adobe HTA delivery), Q3 (the com.microsoft.runedge native-messaging registration — the single most distinctive artifact this campaign publishes), Q7 (webshell spawn from a web-server worker process), and Q11/Q12 (ClientKing ELF drop and execution from non-package-manager Linux paths). Revisit the IOC Appendix once Broadcom publishes an indicator set and replace the REPLACE_WITH_ placeholders.
Source Review & Web Hunter Notes
Six sources were fetched and snapshotted to Jewelbug-XGWeb-Hunt-sources/. Four were captured directly (full-text extraction passes); two (Dark Reading, BleepingComputer) returned HTTP 403 on direct fetch and were reconstructed from search-engine result snippets/summaries — flagged lower-confidence below. No source, on inspection, contained text addressed to the research agent (no prompt-injection attempts observed in any fetched content).
| Tier | Source | Key finding | Carry forward |
|---|---|---|---|
| 1 · Primary vendor | SECURITY.COM — Broadcom Symantec & Carbon Black Threat Hunter Team | XG-Web architecture (React/Node.js/MySQL), malware families, victim-database scale statistics, largest-operation watering-hole detail, operator usernames | Yes — primary basis for all queries and the IOC table |
| 2 · Press | The Hacker News | Confirms dual-mission attribution and quotes the vendor's XG-Web description directly | Partial — corroboration + direct quote |
| 2 · Press | Dark Reading RECONSTRUCTED | Independent confirmation of the three-implant set and a US industrial/aerospace manufacturer as an additional target sector | Partial — direct fetch blocked (HTTP 403); captured via search snippets only |
| 2 · Press | BleepingComputer RECONSTRUCTED | Confirms the 15-tenant webmail watering hole and shared control-panel finding | Partial — direct fetch blocked (HTTP 403); captured via search snippets only |
| 2 · Press | Security Boulevard | ClientKing build count (37) and C2-domain VirusTotal self-check cadence (~12h) | Partial — corroboration + additional technical detail |
| 2 · Press | TechNadu | Geographic connection-volume breakdown, com.microsoft.runedge native-messaging host name, Taiwan-themed decoy documents | Yes — sole source of the native-messaging host string used in Q3 |
Research notes and deliberate exclusions
- No atomic hashes, C2 domains, or IPs were shipped. None of the six fetched sources disclosed literal indicator values — only architecture, scale, and behavior. Rather than infer or approximate values, the IOC Appendix ships
REPLACE_WITH_placeholders for hash/domain/IP rows and this pack leans on behavioral detection instead. Re-run web-hunter-v2 once Broadcom publishes a dedicated IOC list (their historical pattern is a follow-up technical annex). com.microsoft.runedgeis the one concrete atomic-ish string available — a native-messaging host identifier named in two independently-fetched sources (security.com, TechNadu). It ships as a registry/behavioral indicator in Q3 and the IOC Appendix.- Operator usernames ("admin", "admin_s"/"ople500") and the Telegram handle ("paopaodada"/"Bubble Boss") are attribution context, not blockable indicators — carried in the Behavioral Signatures block for analyst awareness only.
- REF770 vs. REF7707: the task brief and Hacker News use "REF770"; four other fetched sources consistently render it "REF7707" (Elastic Security Labs' actual designation). Both are carried in the header/aliases as the discrepancy could not be resolved from the fetched text.
- Dark Reading and BleepingComputer could not be directly fetched (HTTP 403 on repeated attempts, consistent with anti-bot protection rather than any content issue). Their content was reconstructed from search-engine snippets and is marked RECONSTRUCTED throughout this pack; nothing from these two sources was used as the sole basis for a query or IOC.
Hunt Brief & Attack Chain
Hunt hypotheses (ordered by fidelity)
| # | Hypothesis | MITRE | Telemetry | Conf |
|---|---|---|---|---|
| H1 | A native-messaging host registration for com.microsoft.runedge exists, bridging a browser extension to command-shell access | T1176, T1112 | AsepValueUpdate / RegGenericValueUpdate | HIGH |
| H2 | mshta.exe or a script host executed a remotely-hosted HTA with Adobe/Flash-themed lure content (Antino delivery) | T1218.005, T1204.002, T1036.005 | ProcessRollup2 | HIGH |
| H3 | A LOLBin (certutil/bitsadmin/curl) fetched a file with Adobe/Flash-branded naming from a non-Adobe origin | T1105 | ProcessRollup2 | HIGH |
| H4 | A Chrome/Firefox/Edge process launched with an unpacked-extension load flag pointing outside the standard Web Store cache (PDF Viewer sideload) | T1176 | ProcessRollup2 | HIGH |
| H5 | A file matching a browser-extension manifest was written outside the managed-policy or Web Store extension directory structure | T1176, T1204.002 | — (no native Falcon event; §7) | MED |
| H6 | A non-Microsoft-365/non-automation process resolved or connected to the Microsoft Graph API (Antino's documented C2 channel) | T1102.002, T1071.001 | DnsRequest, ProcessRollup2 | MED |
| H7 | A web-server worker process (httpd/nginx/php-fpm/w3wp/tomcat) spawned a shell or scripting interpreter — webshell execution on a webmail/hosting platform | T1505.003 | ProcessRollup2 | HIGH |
| H8 | A script file was written into a shared webmail/CMS common-template directory outside a known change window (watering-hole script injection) | T1505.003 | — (no native Falcon event; §7) | MED |
| H9 | A host on webmail/hosting-tier infrastructure exhibits fixed-cadence outbound beaconing to an external address (XG-Web check-in pattern) | T1071.001 | NetworkConnectIP4 | MED |
| H10 | A rare, low-prevalence domain mimicking a legitimate CDN/font-hosting brand was resolved by a non-browser process (XG-Web C2 hostname masquerading) | T1071.001, T1583.001 | DnsRequest | MED |
| H11 | An ELF binary was written to a world-writable, non-package-manager path on a Linux server or router-class host (ClientKing drop) | T1204.002, T1036.005 | ELFFileWritten | MED |
| H12 | A process executed directly from /tmp, /var/tmp, or /dev/shm on a Linux host (ClientKing execution) | T1204.002, T1059.004 | ProcessRollup2 | HIGH |
| H13 | Cron or systemd persistence was registered referencing a binary in a temp/shared-memory path (ClientKing persistence) | T1053.003, T1543.002 | ProcessRollup2 | HIGH |
| H14 | A single host issued an anomalously high volume of DNS queries to one apex domain (ClientKing DNS-tunneling C2 channel) | T1071.004, T1568 | DnsRequest | MED |
Attack chain
| Step | Behavior | Telemetry | Hunt angle |
|---|---|---|---|
| 1 · Initial access (Windows) | Fake Adobe Flash/installer lure or geopolitically-themed HTA downloader executes Antino | ProcessRollup2 | Q1, Q2 |
| 1b · Initial access (webmail) | Shared web-hosting platform compromised; write access to a common webmail template gained | — (native log only, §7) | §7 |
| 2 · Execution | Antino sideloads the "PDF Viewer" extension into the browser profile and registers com.microsoft.runedge as a native-messaging host | AsepValueUpdate, ProcessRollup2 | Q3, Q4, Q5 |
| 3 · Watering hole | Injected script activates on webmail login/mailbox pages across 15+ tenants at once; serves fake Adobe Flash prompts; opens a WebSocket to XG-Web | NetworkConnectIP4 (template write itself is native-log only, §7) | Q7, Q9, §7 |
| 4 · Collection (browser) | PDF Viewer extension harvests cookies, credentials, session tokens, history, clipboard via its all-sites/debugger permissions | — | GAP — no discrete Falcon event for in-browser extension data access; see Native Audit-Log Hunts |
| 5 · C2 (Antino) | Backdoor communicates over the Microsoft Graph API; XG-Web checks its own C2 domains against VirusTotal roughly every 12 hours for rotation | DnsRequest | Q6, Q10 |
| 6 · Linux/router foothold | ClientKing dropped and executed on Linux servers, ARM64 devices, or ASUS routers; establishes persistence via cron/systemd | ELFFileWritten, ProcessRollup2 | Q11, Q12, Q13 |
| 7 · C2 (ClientKing) | Five transport channels including DNS tunneling; interactive shell, SOCKS pivoting, in-memory kernel-module loading, malicious su/sudo auth module | DnsRequest | Q14 · GAP for in-memory module load and PAM tampering — see Native Audit-Log Hunts |
| 8 · Fraud pipeline (parallel) | 40+ CMS servers push AI-generated OKX/Binance lookalike pages via SEO poisoning and click-fraud bots; same XG-Web panel and operator team | — | Partial — awareness/hardening only, see §12 |
Consolidated IOC Table
No atomic hashes, domains, or IPs were published in any of the six sources fetched for this pack. The table below carries the concrete behavioral/named indicators the sources did disclose, plus explicit gaps. Populate the REPLACE_WITH_ rows in the IOC Appendix (§10) once Broadcom's technical annex or a follow-up report publishes hashes/domains/IPs, and re-run check_ioc_provenance.py before shipping an updated version.
| Type | Value | Conf | Action | Context |
|---|---|---|---|---|
| Native messaging host ID | com.microsoft.runedge | HIGH | hunt | Antino-registered native-messaging bridge granting the PDF Viewer extension command-shell access; named in security.com and TechNadu |
| Extension display name | PDF Viewer | MEDIUM | enrich | Generic name, likely to be re-used or varied by the actor — pivot signal, not a standalone block condition |
| Named tooling | XG-Web / Antino / ClientKing | HIGH | enrich | Vendor-attributed malware family names for tagging and correlation across future intel |
| Attribution — Telegram handle | paopaodada ("Bubble Boss") | MEDIUM | pivot | Crypto-fraud commercial front operator handle; not a Falcon-importable indicator type, context only |
| SHA256 (Antino, PDF Viewer, ClientKing) | REPLACE_WITH_SHA256 | — | — | Not published in any fetched source as of 2026-08-15; do not fabricate — populate when available |
| Domain (XG-Web C2 / fake-Adobe lure) | REPLACE_WITH_DOMAIN | — | — | Not published; hunt with Q10 (rare lookalike-CDN domain pattern) until a literal value is disclosed |
| IPv4 (XG-Web check-in infrastructure) | REPLACE_WITH_IPV4 | — | — | Not published; hunt with Q9 (beaconing cadence) until a literal value is disclosed |
Affected Surface & Telemetry Matrix
| Surface | Required telemetry | Priority | Gap risk |
|---|---|---|---|
| Windows workstations (browser-using staff, especially government/telecom/webmail-admin roles) | ProcessRollup2, SyntheticProcessRollup2, AsepValueUpdate | CRITICAL | Low — standard Falcon sensor coverage |
| Browser extension install/persistence surface (Chrome, Edge, Firefox) | ProcessRollup2 (launch flags), AsepValueUpdate (native-messaging registry); extension-directory writes are native-log only, no Falcon event (§7) | CRITICAL | High — Falcon has no dedicated "extension installed" event; detection is indirect (flags, registry, file paths) |
| Webmail / shared hosting platforms (server-side) | ProcessRollup2 (web-server child processes); template writes are native-log only, no Falcon event (§7) | CRITICAL | Medium — depends on sensor deployment on hosting/webmail infrastructure, which is often unmanaged or third-party |
| Outbound network from webmail/hosting tier and workstations | NetworkConnectIP4, DnsRequest | HIGH | Low |
| Microsoft Graph API C2 channel (Antino) | DnsRequest, ProcessRollup2 (correlated) | HIGH | Medium — high legitimate baseline volume to graph.microsoft.com requires tuning |
| Linux servers, ARM64 devices (ClientKing) | ELFFileWritten, ProcessRollup2, DnsRequest | CRITICAL | Medium — sensor coverage on Linux server fleets is frequently thinner than Windows workstation coverage |
| Consumer/SOHO routers (ASUS observed for ClientKing) | — | HIGH | HIGH — Falcon sensor does not run on router firmware; coverage is network-edge only (DNS/NetworkConnect from adjacent hosts) or via router-vendor logging, see Native Audit-Log Hunts |
| In-browser data access (cookie/credential theft by the extension itself) | — | HIGH | HIGH — no discrete Falcon event for extension-level DOM/cookie access; detection is install/persistence-time only |
| Kernel-module in-memory loading, PAM/su/sudo tampering (ClientKing) | — | HIGH | HIGH — Falcon has no dedicated in-memory kernel-module-load event in this reference; pair with auditd/kernel audit logging |
ATT&CK Mapping
| Tactic | Technique | Observed behavior | Query / control |
|---|---|---|---|
| Initial Access | T1189 — Drive-by Compromise | Watering-hole script served to webmail visitors from a compromised shared hosting platform | Q7, §7 |
| Initial Access | T1566 — Phishing (fake Adobe/Flash lure) | HTA and installer lures themed around Adobe products and current geopolitical events | Q1, Q2 · user training |
| Execution | T1218.005 — Mshta | Remote HTA executed by mshta.exe to deliver Antino | Q1 |
| Execution | T1204.002 — Malicious File | Fake Adobe installer / Flash update executed by the user | Q2 |
| Execution | T1059.004 — Unix Shell | ClientKing executed from a temp/shared-memory path on Linux | Q12 |
| Persistence | T1176 — Browser Extensions | "PDF Viewer" malicious extension sideloaded and persisted in the browser profile | Q4, §7 |
| Persistence | T1112 — Modify Registry | Native-messaging host com.microsoft.runedge registered to bridge extension-to-shell access | Q3 |
| Persistence | T1053.003 — Cron | ClientKing cron persistence referencing a temp-path binary on Linux | Q13 |
| Persistence | T1543.002 — Systemd Service | ClientKing systemd unit persistence on Linux/router-class hosts | Q13 |
| Defense Evasion | T1036.005 — Match Legitimate Name or Location | Native-messaging host masquerades as a Microsoft Edge component (com.microsoft.runedge); ELF payloads dropped under generic temp names | Q3, Q11 |
| Defense Evasion | T1622 — Debugger Evasion / T1497-adjacent | XG-Web checks its own C2 domains against VirusTotal roughly every 12 hours for pre-emptive rotation | GAP — infrastructure-side behavior, not endpoint-visible |
| Credential Access | T1555.003 — Credentials from Web Browsers | PDF Viewer extension harvests stored credentials and session cookies | GAP · Q3–Q5 detect install/persistence, not the theft itself |
| Credential Access | T1556 — Modify Authentication Process | ClientKing's malicious su/sudo authentication module captures Linux credentials | GAP · Native Audit-Log Hunts (PAM integrity) |
| Collection | T1185 — Browser Session Hijacking | 580,000+ browser cookies exfiltrated across the observed campaign; WebSocket-based cookie theft from injected webmail script | Q9 |
| Collection | T1114 — Email Collection | 2,300+ email bodies exfiltrated from compromised webmail sessions | Q7, §7 |
| Command and Control | T1071.001 — Web Protocols | XG-Web check-in beaconing; WebSocket C2 from injected webmail script | Q9 |
| Command and Control | T1102.002 — Bidirectional Communication (Web Service) | Antino uses the Microsoft Graph API as a covert C2 channel | Q6 |
| Command and Control | T1583.001 — Acquire Infrastructure: Domains | C2 hostnames crafted to mimic legitimate CDN/font-hosting brands | Q10 |
| Command and Control | T1071.004 — DNS | ClientKing DNS-tunneling C2 transport channel | Q14 |
| Command and Control | T1572 — Protocol Tunneling | ClientKing SOCKS pivoting into internal networks from compromised Linux/router hosts | Partial — Q14 covers the DNS channel only |
| Rootkit / Defense Evasion | T1014 — Rootkit | ClientKing kernel-module rootkit loaded directly from memory | GAP — pair with auditd init_module/finit_module syscall auditing |
| Resource Development (fraud arm) | T1583.001, T1608.006 — SEO Poisoning | AI-generated fake OKX/Binance exchange pages boosted by click-fraud bots across 40+ CMS servers | Partial — hardening/awareness only, §12 |
Native Audit-Log Hunts
Checks that do not require Falcon telemetry — run these in parallel, especially for the router and in-browser gaps flagged above where EDR visibility is inherently limited.
- Chrome/Edge managed-policy audit (
chrome://policyor Intune/GPO report) — confirmExtensionInstallBlocklist/ExtensionInstallAllowlistis enforced fleet-wide and that developer-mode / unpacked-extension loading is disabled for non-developer roles. - Browser extension inventory — enumerate installed extensions across the fleet (Chrome/Edge/Firefox management console or endpoint agent) and flag any generically-named "PDF Viewer" / document-reader extension not sourced from your approved vendor list.
- Windows Registry review —
HKLM/HKCU\Software\Google\Chrome\NativeMessagingHostsand the Mozilla equivalent for any entry namedcom.microsoft.runedgeor resembling a legitimate Microsoft/Edge component that is not actually shipped by Microsoft. - Web server / hosting platform access logs — review for unexpected write operations (PUT/POST to admin or template-upload endpoints) against shared webmail template directories outside a documented change window; cross-reference with your CMS/webmail change-management log.
- auditd on Linux hosts — rules on
execvefrom/tmp,/var/tmp,/dev/shm;init_module/finit_modulesyscalls (kernel-module loads outside your patch process); and writes to/etc/pam.d/or PAM module directories (ClientKing's su/sudo credential-theft module). - Cron and systemd audit —
crontab -lfleet sweep andsystemctl list-unit-filesfor any entry executing from a temp or shared-memory path. - Router/SOHO device audit (ASUS and similar consumer-grade gear observed) — firmware version against latest vendor release, admin-interface exposure to WAN, and DNS-tunneling indicators in the router's own query logs (many queries to one apex domain, unusually long subdomain labels).
- DNS resolver logs — resolution of newly-registered or CDN-mimicking domains from server-tier hosts that have no legitimate reason to serve web fonts/static assets themselves.
- Conditional Access / Entra sign-in logs — anomalous application registrations or OAuth grants scoped to Microsoft Graph from hosts/accounts with no legitimate Graph API integration.
CrowdStrike LogScale CQL Hunt Queries
Looks for: mshta.exe handed a remote URL argument that also carries an Adobe/Flash-themed keyword — Antino's documented delivery vector. FP: rare; a small number of legacy line-of-business apps invoke remote HTAs, none plausibly Adobe/Flash-themed.
// HUNT: mshta.exe executing a remotely-hosted HTA with Adobe/Flash-themed content // MITRE: T1218.005, T1204.002, T1036.005 // CONF: high // FP: low // COST: low // REQUIRES: ProcessRollup2, SyntheticProcessRollup2 // FALSE POSITIVES: none expected — legitimate HTAs are not Adobe/Flash-themed #event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ | FileName=/^mshta(\.exe)?$/i | CommandLine=/https?:\/\//i | CommandLine=/adobe|flash/i | table([ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData])
Looks for: certutil, bitsadmin, curl or mshta invoked with an Adobe/Flash-branded target — the fake-installer stage of Antino delivery. FP: low; these binaries do not legitimately fetch Adobe-branded content in most enterprise environments.
// HUNT: LOLBin retrieving a fake Adobe/Flash-branded payload // MITRE: T1105, T1204.002 // CONF: high // FP: low // COST: low // REQUIRES: ProcessRollup2, SyntheticProcessRollup2 // FALSE POSITIVES: none expected in most enterprise baselines #event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ | in(FileName, values=["certutil.exe","bitsadmin.exe","curl.exe","mshta.exe"], ignoreCase=true) | CommandLine=/adobe|flashplayer|flash_install/i | table([ComputerName, UserName, FileName, CommandLine, SHA256HashData])
Looks for: the single most distinctive published artifact of this campaign — registration of a native-messaging host named com.microsoft.runedge, which is not a real Microsoft component. This is the highest-value query in the pack. FP: effectively none — the string is fabricated to impersonate Microsoft Edge and does not exist in a legitimate install.
// HUNT: Native-messaging host registered for com.microsoft.runedge // MITRE: T1176, T1112 // CONF: high // FP: low // COST: low // REQUIRES: AsepValueUpdate, RegGenericValueUpdate // FALSE POSITIVES: none observed — this native-messaging host name is not a genuine Microsoft component #event_simpleName=/^(AsepValueUpdate|RegGenericValueUpdate)$/ | RegObjectName=/NativeMessagingHosts/i | RegObjectName=/com\.microsoft\.runedge/i | table([ComputerName, UserName, RegObjectName, RegValueName, RegStringValue])
Looks for: Chrome/Edge/Firefox launched with a command-line flag that side-loads an unpacked extension — bypassing the Web Store review Antino's PDF Viewer would otherwise need to pass. FP: web developers legitimately use this flag; scope to non-developer host groups before alerting.
// HUNT: Browser process launched with an unpacked-extension load flag // MITRE: T1176 // CONF: high // FP: low // COST: low // REQUIRES: ProcessRollup2, SyntheticProcessRollup2 // FALSE POSITIVES: web developers using --load-extension for local testing #event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ | in(FileName, values=["chrome.exe","msedge.exe","firefox.exe"], ignoreCase=true) | CommandLine=/--load-extension=/i | table([ComputerName, UserName, FileName, CommandLine])
Looks for: a manifest.json written into a Chrome/Firefox extension directory outside a managed-policy or Web-Store path.
Not CQL — no native Falcon event covers this. Falcon's file-write telemetry (NewExecutableWritten, PeFileWritten, ElfFileWritten, JarFileWritten, ZipFileWritten, DocumentFileWritten) covers compiled/known-typed artifacts only — there is no discrete sensor event for an arbitrary manifest.json or unpacked-directory write. Run the Chrome/Edge managed-policy audit and browser extension inventory checks in §7 (Native Audit-Log Hunts) instead. Q3 (native-messaging registry) and Q4 (unpacked-load launch flag) are the Falcon-visible proxies for this same persistence step — treat them as primary, and this manifest-write check as a supplementary native sweep.
Looks for: processes other than the common legitimate Graph consumers (Outlook, Teams, OneDrive, Edge/Chrome, Windows Search, Intune-family agents) resolving graph.microsoft.com — Antino's documented C2 channel. FP: custom line-of-business Graph integrations and PowerShell Graph SDK automation will also hit this; exclude known service accounts and signed automation before alerting.
// HUNT: Non-standard process resolving the Microsoft Graph API domain // MITRE: T1102.002, T1071.001 // CONF: medium // FP: medium // COST: low // REQUIRES: DnsRequest, ProcessRollup2 // FALSE POSITIVES: PowerShell Graph SDK automation, Intune/Defender agents, legitimate custom Graph integrations // TUNING: exclude your known Graph-integration service accounts and signed automation parents before alerting; scope to workstation/server fleets that have no documented Graph API use case #event_simpleName=/^DnsRequest$/ | DomainName=/^graph\.microsoft\.com$/i | rename(field=ContextProcessId_decimal, as=TargetProcessId_decimal) | join(query={#event_simpleName=/^ProcessRollup2$/}, field=TargetProcessId_decimal, include=[FileName, ParentBaseFileName, CommandLine]) | !in(FileName, values=["outlook.exe","teams.exe","onedrive.exe","searchprotocolhost.exe","microsoftedgeupdate.exe","chrome.exe","msedge.exe","firefox.exe"], ignoreCase=true) | table([ComputerName, UserName, FileName, ParentBaseFileName, CommandLine, DomainName])
Looks for: a webmail/hosting web-server worker (httpd, nginx, php-fpm, w3wp, tomcat) spawning a shell or interpreter — the classic webshell-execution pattern that matches Jewelbug's watering-hole write-access technique. FP: some legitimate CMS/webmail maintenance scripts do shell out from the web-server user; exclude your known deployment/patch automation.
// HUNT: Web-server worker process spawning a shell or scripting interpreter // MITRE: T1505.003 // CONF: high // FP: medium // COST: low // REQUIRES: ProcessRollup2, SyntheticProcessRollup2 // FALSE POSITIVES: legitimate CMS/webmail deployment or maintenance scripts that shell out from the web-server account // TUNING: exclude your known deployment-automation parent command lines and scheduled-maintenance windows before alerting #event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ | in(ParentBaseFileName, values=["httpd","httpd.exe","nginx","nginx.exe","php-fpm","php-cgi","w3wp.exe","tomcat","java","apache2"], ignoreCase=true) | in(FileName, values=["cmd.exe","powershell.exe","pwsh.exe","sh","bash","wget","curl","nc","ncat","python","python3","perl"], ignoreCase=true) | table([ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData])
Looks for: a server-side script file written into a common webmail/CMS template path — the exact mechanism the vendor described for the 15-tenant watering hole.
Not CQL — no native Falcon event covers this. An interpreted script (.php/.jsp/.asp/.cgi) dropped into a template directory is not a compiled artifact, so it falls outside Falcon's file-write event set the same way an uncompiled webshell drop does. Hunt this via the web server / hosting platform access logs check in §7 (unexpected PUT/POST to template-upload endpoints outside a change window) and file-integrity monitoring on the template directories. Q7 (web-server worker spawning a shell/interpreter) is the Falcon-visible proxy for the execution step that follows this write — treat it as primary detection and this as the native compensating check.
Looks for: host/external-IP pairs communicating on a regular 5-minute cadence for over an hour, with low per-bucket volume — the shape of an automated check-in like XG-Web's implant registration rather than interactive browsing. Scope to server/hosting-tier host groups for best signal. FP: legitimate monitoring agents, license-check callbacks, and update services beacon similarly; exclude known-good vendor endpoints.
// HUNT: Fixed-cadence outbound beaconing from webmail/hosting-tier hosts // MITRE: T1071.001 // CONF: medium // FP: medium // COST: medium // REQUIRES: NetworkConnectIP4 // FALSE POSITIVES: legitimate monitoring/license-check/update-service beacons follow similar cadences // TUNING: exclude known-good vendor telemetry and update-service destinations by RemoteAddressIP4 or ASN before alerting; scope aid to your webmail/hosting host group first // LOOKBACK: 24h -- set the window with the Falcon time picker #event_simpleName=/^NetworkConnectIP4$/ | !cidr(RemoteAddressIP4, subnet="10.0.0.0/8") | !cidr(RemoteAddressIP4, subnet="172.16.0.0/12") | !cidr(RemoteAddressIP4, subnet="192.168.0.0/16") | !cidr(RemoteAddressIP4, subnet="127.0.0.0/8") | Bucket5m := @timestamp - (@timestamp % 300000) | groupBy([ComputerName, RemoteAddressIP4, Bucket5m], function=count(as=ConnsInBucket), limit=20000) | groupBy([ComputerName, RemoteAddressIP4], function=[count(as=BucketsActive), avg(ConnsInBucket, as=AvgConnsPerBucket)], limit=5000) | BucketsActive > 12 | AvgConnsPerBucket < 5 | sort(BucketsActive, order=desc)
Looks for: domains containing CDN/font-hosting-style keywords but resolved by very few hosts — the pattern the vendor described for C2 hostnames "mimicking legitimate resources like Google Fonts." FP: internal or third-party CDN reseller domains can match the keyword filter; verify each hit manually before blocking.
// HUNT: Rare CDN/font-brand-mimicking domain resolved by very few hosts // MITRE: T1071.001, T1583.001 // CONF: medium // FP: medium // COST: medium // REQUIRES: DnsRequest // FALSE POSITIVES: legitimate internal or reseller CDN/font-hosting domains can match the keyword filter // TUNING: extend the exclusion list below with your organization's approved CDN/font/asset vendors before alerting; verify each surfaced domain manually — this is a hunt query, not an auto-block candidate // LOOKBACK: 7d -- set the window with the Falcon time picker #event_simpleName=/^DnsRequest$/ | DomainName=/font|fonts|cdn|static|assets/i | !DomainName=/\.(microsoft|google|googleapis|gstatic|cloudflare|akamai|jsdelivr|fastly)\.com$/i | groupBy(DomainName, function=[count(as=TotalQueries), count(aid, distinct=true, as=DistinctHosts), collect(ComputerName, limit=20)], limit=20000) | DistinctHosts < 4 | TotalQueries > 4 | sort(DistinctHosts, order=asc)
Looks for: an ELF executable written into a world-writable temp or shared-memory path — where ClientKing (and most Linux/router implants) must land before execution, since neither location is under package-manager control. FP: some build/CI pipelines legitimately compile into /tmp; scope this hunt to your server and router/edge fleet rather than build infrastructure.
// HUNT: ELF binary written to /tmp, /var/tmp, /dev/shm, /home, or /root // MITRE: T1204.002, T1036.005 // CONF: medium // FP: medium // COST: low // REQUIRES: ELFFileWritten // FALSE POSITIVES: CI/CD build runners and containerized pipelines that legitimately compile into /tmp // TUNING: exclude your CI/CD runner and build-agent host groups before alerting; scope to production server and router/edge fleets #event_simpleName=/^ELFFileWritten$/ | TargetFileName=/^\/(tmp|var\/tmp|dev\/shm|home|root)\/[^\/]+$/i | table([ComputerName, UserName, TargetFileName, SHA256HashData])
Looks for: execution of a binary directly from a world-writable temp path — pairs with Q11 to catch drop-and-run behavior even where the write event is missed or unavailable. FP: containerized CI runners commonly execute build artifacts from /tmp; exclude known build infrastructure.
// HUNT: Process execution from /tmp, /var/tmp, or /dev/shm on Linux // MITRE: T1204.002, T1059.004 // CONF: high // FP: medium // COST: low // REQUIRES: ProcessRollup2, SyntheticProcessRollup2 // FALSE POSITIVES: containerized CI/CD runners executing build artifacts from /tmp // TUNING: exclude your CI/CD runner and build-agent host groups; scope to server/router-adjacent fleets outside build infrastructure before alerting #event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ | ImageFileName=/^\/(tmp|var\/tmp|dev\/shm)\//i | table([ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData])
Looks for: crontab or systemctl invoked with a command line referencing a temp-path binary — persistence registration for an implant that must live outside package-manager-controlled paths. FP: low; legitimate cron/systemd units almost never point at /tmp-class paths.
// HUNT: Cron or systemd persistence referencing a temp-path binary // MITRE: T1053.003, T1543.002 // CONF: high // FP: low // COST: low // REQUIRES: ProcessRollup2, SyntheticProcessRollup2 // FALSE POSITIVES: rare — legitimate scheduled jobs almost never reference /tmp, /var/tmp, or /dev/shm #event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ | in(FileName, values=["crontab","systemctl"], ignoreCase=true) | CommandLine=/tmp|dev\/shm/i | table([ComputerName, UserName, FileName, CommandLine])
Looks for: a single host issuing an unusually high volume of DNS queries to one apex domain within an hour — the traffic shape of a DNS-tunneling C2 channel, one of ClientKing's five documented transports. FP: legitimate high-volume resolvers, CDN health checks, and misconfigured retry loops also trip this; tune the threshold to your environment's baseline.
// HUNT: Anomalous single-host, single-domain DNS query volume (tunneling shape) // MITRE: T1071.004, T1568 // CONF: medium // FP: medium // COST: medium // REQUIRES: DnsRequest // FALSE POSITIVES: legitimate high-volume DNS resolvers, CDN health-check loops, or misconfigured retry logic // TUNING: exclude known DNS-heavy service hosts (resolvers, load balancers, health-check systems) and re-baseline the 200-query threshold against your environment before alerting // LOOKBACK: 3600000ms -- set the window with the Falcon time picker #event_simpleName=/^DnsRequest$/ | groupBy([ComputerName, DomainName], function=count(as=QueryCount), limit=20000) | QueryCount > 200 | sort(QueryCount, order=desc)
CrowdStrike Custom IOA Recommendations
Three queries are strong Custom IOA candidates — low false-positive ceiling, specific, and durable regardless of infrastructure rotation. The remainder stay Investigate-only until tuned against a live tenant baseline.
| Query | IOA name | Pattern | Exclusions | Deployment path |
|---|---|---|---|---|
| Q3 | ioa-jewelbug-runedge-native-messaging | Registry write to NativeMessagingHosts\com.microsoft.runedge | None required | Promote directly to Custom IOA — highest confidence, zero known FP |
| Q1 | ioa-jewelbug-mshta-adobe-hta | mshta.exe + remote URL + Adobe/Flash keyword in CommandLine | None required at time of build; monitor for internal HTA tooling | Promote to Custom IOA after a 2-week Investigate-only baseline |
| Q13 | ioa-jewelbug-cron-systemd-temppath | Cron/systemd registration referencing /tmp, /var/tmp, or /dev/shm | None required | Promote to Custom IOA — low FP, Linux/router fleet |
| Q2, Q4, Q7, Q12 | — | Behaviorally strong but environment-dependent (web-server tech stack, browser fleet composition, CI/CD footprint) | See per-query TUNING lines | Investigate-only; promote after a tenant-specific tuning pass |
| Q6, Q9, Q10, Q11, Q14 | — | Medium confidence / medium FP by design — broad pivot and hunt queries | See per-query TUNING lines | Investigate-only; route hits to a daily review queue, not an alert |
| Q5, Q8 | — | Not CQL — no native Falcon event exists for these writes | N/A | Native audit-log hunt only, see §7 |
Machine-Readable IOC Appendix
No atomic hash, domain, or IP indicators were published in any fetched source as of 2026-08-15. The CSV block below ships REPLACE_WITH_ placeholders only, per pipeline policy — populate them from Broadcom's technical annex (if/when released) and re-run the provenance gate before shipping an update.
type,value,action,severity,expiration,description,tags sha256,REPLACE_WITH_SHA256,prevent,critical,2027-02-15,Antino Windows backdoor payload,campaign:Jewelbug sha256,REPLACE_WITH_SHA256,prevent,critical,2027-02-15,PDF Viewer malicious browser extension package,campaign:Jewelbug sha256,REPLACE_WITH_SHA256,prevent,critical,2027-02-15,ClientKing Rust Linux/router implant binary,campaign:Jewelbug domain,REPLACE_WITH_DOMAIN,detect,high,2026-11-15,XG-Web control-panel rendezvous / C2 domain,campaign:Jewelbug domain,REPLACE_WITH_DOMAIN,detect,high,2026-11-15,Fake Adobe installer / Flash-update lure domain,campaign:Jewelbug ipv4,REPLACE_WITH_IPV4,detect,medium,2026-11-15,XG-Web check-in / C2 IPv4 endpoint,campaign:Jewelbug
# Jewelbug / XG-Web — behavioral signatures (no atomic IOCs published as of this build)
Native messaging host ID: com.microsoft.runedge
-- registered by Antino to bridge PDF Viewer extension commands to a shell (Q3)
Malicious extension display name: "PDF Viewer"
-- Chrome/Firefox; requests cookies, debugger, native-messaging, all-sites scripting
XG-Web C2 domain pattern: hostnames crafted to mimic legitimate CDN/font-hosting brands
-- e.g. Google Fonts-style naming (Q10)
XG-Web self-defense: own C2 domains checked against VirusTotal roughly every 12 hours for rotation
Antino C2 channel: Microsoft Graph API (graph.microsoft.com) abused for command-and-control (Q6)
ClientKing: Rust binary, 37 known build variants; x86-64 Linux servers, ARM64 devices, ASUS routers
-- 5 C2 transports incl. DNS tunneling (Q14); SOCKS pivoting; in-memory kernel-module loading;
malicious su/sudo authentication module for credential theft
Watering-hole vector: write access to a shared webmail/hosting common template; 15+ tenants hit at once (Q7, Q8)
XG-Web -- browser-centric remote-access & info-stealing control panel (React/Node.js/MySQL) Antino -- Windows backdoor; HTA/fake-Adobe delivery; Microsoft Graph API C2 PDF Viewer -- malicious Chrome/Firefox extension (credential, cookie, session, clipboard theft) ClientKing -- Rust Linux/router implant (SOCKS pivot, DNS tunneling, in-memory kernel modules) com.microsoft.runedge -- native-messaging host bridging PDF Viewer to local command execution
# Jewelbug / XG-Web audit checklist [ ] Browser extension inventory reconciled against an approved-vendor allowlist fleet-wide [ ] ExtensionInstallBlocklist / ExtensionInstallAllowlist (GPO or MDM) enforced; unpacked/dev-mode load disabled [ ] Write-access controls + file-integrity monitoring enabled on shared webmail/hosting template directories [ ] Conditional-access / sign-in logs reviewed for anomalous Microsoft Graph API app registrations [ ] Linux/router fleet: noexec,nosuid on /tmp, /var/tmp, /dev/shm; kernel module signing enforcement [ ] auditd rules present for init_module/finit_module syscalls and /etc/pam.d/ writes [ ] Router/SOHO firmware (ASUS and similar) current; admin interface not WAN-exposed
Detection Validation Gates
| Gate | Requirement | Status for this pack |
|---|---|---|
| Telemetry ready | ProcessRollup2/SyntheticProcessRollup2, AsepValueUpdate/RegGenericValueUpdate, ElfFileWritten, DnsRequest, NetworkConnectIP4 enabled on target host groups (Q5/Q8 are native-log checks, not sensor-dependent) | Verify in tenant — Linux server and router-adjacent sensor coverage should be confirmed explicitly, it is frequently thinner than Windows workstation coverage |
| Benign baseline | Run each Investigate-only query (Q6, Q9, Q10, Q11, Q12, Q14) over a 7-day window before enabling any alert; record hit volume and manually clear known-good sources into the TUNING exclusion | Not yet run — first deployment |
| Positive tests | Q1–Q4 and Q13 can be positively tested with a benign HTA/extension-load/cron-line simulation in a lab VM (no live malware required) to confirm field names and event availability in your tenant | Recommended before promoting Q1, Q3, Q13 to Custom IOA |
| Promotion criteria | Zero false positives across a 2-week Investigate-only run, or an FP rate the SOC explicitly accepts for the query's severity | Applies to Q1, Q3, Q13 per §9 |
Hardening — Tiered & Deployable
Browser extension lockdown (M1038 — Execution Prevention / M1042 — Disable or Remove Feature or Program): Enforce ExtensionInstallBlocklist (deny-by-default with an explicit allowlist) via Chrome/Edge GPO or MDM policy; disable developer-mode/unpacked-extension loading for non-developer roles. Reference: Google Chrome Enterprise policy documentation, ExtensionInstallBlocklist/ExtensionInstallAllowlist.
Native-messaging host restriction (M1042): Restrict which native-messaging hosts browsers are permitted to invoke via the NativeMessagingAllowlist/NativeMessagingBlocklist Chrome policy, closing the exact bridge Antino uses for com.microsoft.runedge.
Webmail/hosting write-access lockdown (M1022 — Restrict File and Directory Permissions): Confirm the webmail/CMS application account cannot write to its own template/theme directories in production; deploy via a read-only filesystem layer or mandatory access control (SELinux/AppArmor) for the web-server user.
Linux temp-path execution restriction (M1038): Mount /tmp, /var/tmp, and /dev/shm with noexec,nosuid across the server and router-adjacent fleet, closing ClientKing's primary drop-and-run path (Q11/Q12). Pilot on a non-production ring first — some legitimate software unpacks and executes temporary helper binaries.
PAM/auth-module integrity monitoring (M1022, M1047 — Audit): Deploy file-integrity monitoring on /etc/pam.d/ and the PAM module directory to catch ClientKing's malicious su/sudo authentication module at write time, closing the T1556 gap noted in §6.
Conditional Access review for Graph API (M1047): Audit and constrain which applications/service principals hold Microsoft Graph API scopes; alert on new app registrations requesting broad Graph permissions.
Kernel module signing enforcement (M1051 — Update Software / platform hardening): Enforce signed-module-only loading (module.sig_enforce=1) across the Linux server fleet to block ClientKing's in-memory kernel-module rootkit capability.
Router/SOHO fleet lifecycle management (M1051): Establish an inventory and patch-currency program for consumer-grade network devices (ASUS and similar) in scope of business use; disable WAN-facing admin interfaces org-wide.
Webmail platform architecture review (M1030 — Network Segmentation): For shared/multi-tenant webmail hosting, evaluate per-tenant template isolation so a single compromised write path cannot cascade into a simultaneous multi-tenant watering hole, as observed in Jewelbug's largest documented operation.
Deployable Playbooks
Playbook 1 — Chrome/Edge extension and native-messaging lockdown (Windows, GPO)
Prerequisites: Domain-joined Windows fleet with Chrome/Edge ADMX templates loaded into the Group Policy Central Store; test in a pilot OU before fleet-wide rollout.
Reboot required: No — policy applies on next Chrome/Edge relaunch or gpupdate /force.
Rollback: Remove or disable the GPO; extensions previously blocked can be reinstalled by users once the policy is unlinked (no data loss, reversible).
1. Open Group Policy Management Console -> create/edit GPO "Browser-Extension-Lockdown" 2. Computer Configuration -> Policies -> Administrative Templates -> Google/Microsoft Edge -> Extensions 3. Enable "Configure extension installation blocklist": value = * (block all by default) 4. Enable "Configure extension installation allowlist": add your approved extension IDs 5. Computer Configuration -> Administrative Templates -> Google/Microsoft Edge -> Native Messaging 6. Enable "Configure native messaging blocklist": value = * 7. Enable "Configure native messaging allowlist": add only required native-messaging host IDs 8. Link the GPO to a pilot OU; verify with: gpresult /r (confirm policy applied) 9. Verify in chrome://policy that ExtensionInstallBlocklist and NativeMessagingBlocklist show "*" 10. Expand to production OUs after a 1-week pilot with no user-reported breakage
Playbook 2 — Linux temp-path execution restriction (noexec/nosuid)
Prerequisites: Root/sudo access; confirm no production workload legitimately executes binaries from /tmp, /var/tmp, or /dev/shm (check first with the audit command below) before enforcing.
Reboot required: No — remount takes effect immediately; a reboot only re-applies the change from fstab on next boot, which is desired for persistence.
Rollback: Remove the noexec,nosuid options from /etc/fstab and re-run mount -o remount /tmp (and the other paths); fully reversible, no data loss.
1. Audit first — identify anything currently executing from these paths (run for 48h before enforcing): auditctl -a always,exit -F arch=b64 -S execve -F dir=/tmp -k tmp_exec_audit auditctl -a always,exit -F arch=b64 -S execve -F dir=/var/tmp -k vartmp_exec_audit ausearch -k tmp_exec_audit 2. Back up /etc/fstab: cp /etc/fstab /etc/fstab.bak-2026-08-15 3. Edit /etc/fstab, add noexec,nosuid to the /tmp, /var/tmp, and /dev/shm mount lines, e.g.: tmpfs /tmp tmpfs defaults,noexec,nosuid,nodev 0 0 4. Apply without reboot: mount -o remount /tmp && mount -o remount /var/tmp && mount -o remount /dev/shm 5. Verify: mount | grep -E '/tmp|/var/tmp|/dev/shm' -- confirm noexec present 6. Confirm no legitimate service failed: journalctl -p err --since "10 minutes ago" 7. Rollback if needed: restore /etc/fstab.bak-2026-08-15, then remount without noexec,nosuid
Playbook 3 — Webmail/CMS template write-access lockdown
Prerequisites: Root/admin access to the web-server host; identify the exact template/theme directory path for your webmail/CMS product before starting; schedule during a maintenance window since the application must be able to write during legitimate upgrades.
Reboot required: No — filesystem permission and web-server config changes apply on next config reload.
Rollback: Restore previous ownership/permissions from the recorded baseline (step 1) and reload the web server; fully reversible.
1. Record current baseline before changing anything:
stat -c '%U:%G %a %n' /path/to/webmail/templates/* > /root/webmail-perms-baseline-2026-08-15.txt
2. Set the template directory to read-only for the web-server runtime user:
chown -R root:webserver-group /path/to/webmail/templates
chmod -R 755 /path/to/webmail/templates
find /path/to/webmail/templates -type f -exec chmod 644 {} \;
3. If using SELinux, set an explicit read-only context on the directory:
semanage fcontext -a -t httpd_sys_content_t "/path/to/webmail/templates(/.*)?"
restorecon -Rv /path/to/webmail/templates
4. Deploy application updates via your CI/CD or package pipeline instead of live in-place writes:
document the sanctioned update path so admins do not need to re-open write access manually
5. Add file-integrity monitoring on the directory (e.g. auditd watch rule):
auditctl -w /path/to/webmail/templates -p wa -k webmail_template_integrity
6. Verify enforcement: attempt a write as the web-server user and confirm it is denied
7. Rollback if an update breaks: restore ownership/permissions from webmail-perms-baseline-2026-08-15.txt
Containment Runbook
| Phase | Actions | Owner | Evidence to preserve |
|---|---|---|---|
| 1 · Isolate | Network-contain the affected host (Falcon network containment for Windows/Linux endpoints); for a webmail/hosting-tier compromise, remove the host from the load-balancer pool rather than a hard shutdown to preserve forensic state | IR lead / SOC | Live memory snapshot; running-process list; open network connections |
| 1b · Isolate (browser) | Disable/remove the identified malicious extension fleet-wide via managed policy push; force-close browser sessions on affected endpoints to invalidate stolen session cookies | Endpoint team | Extension ID, manifest, and native-messaging registry key before removal |
| 2 · Eradicate | Remove the com.microsoft.runedge native-messaging registration and the PDF Viewer extension; remove Antino persistence artifacts; on Linux/router hosts remove ClientKing binary, cron/systemd entries, and any PAM module tampering; rotate all credentials/session tokens observed on the host | Endpoint + Identity teams | Full binary/artifact set for hash generation; PAM config diff; cron/systemd unit content |
| 2b · Eradicate (webmail) | Remove the injected script from the shared template; audit ALL tenants on the shared platform (Jewelbug's pattern is simultaneous multi-tenant injection from one write), not just the initially-identified tenant | Hosting/platform team | Full diff of template before/after; write-access logs identifying the initial compromise vector |
| 3 · Recover | Restore template/theme files from a known-good backup; re-enable write access only through the sanctioned CI/CD path (Playbook 3); reissue credentials for all accounts with sessions active during the exposure window; re-image any host where kernel-module tampering is suspected rather than attempting in-place remediation | Platform + Identity teams | Restoration timestamp; credential-rotation log; re-imaging record |
| 4 · Post-incident | Confirm Q1–Q14 all return clean for the affected host group across a 7-day observation window; brief staff at government/telecom/webmail-admin roles on the fake-Adobe/Flash lure pattern; if crypto-exchange impersonation phishing was the entry vector for any individual, route to the awareness track in §12 | SOC + Security Awareness | Clean-hunt confirmation record; awareness-briefing attendance |
Crypto-fraud angle (awareness, not EDR-huntable): the OKX/Binance lookalike-domain and SEO-poisoning side of this campaign targets individuals directly (personal crypto-wallet theft) rather than corporate endpoints, and is not meaningfully detectable via Falcon telemetry. Route this to security-awareness communications: teach staff to navigate to exchanges by bookmarked/typed URL rather than search results, verify exchange URLs against the vendor's official domain list, and treat unsolicited "search-ranking" or exchange-related Telegram contact as a red flag.
Detection Coverage Map
| Technique | Behavior | CQL | IOA | Coverage |
|---|---|---|---|---|
| T1218.005 / T1204.002 | Antino HTA/fake-Adobe delivery | Q1, Q2 | ioa-jewelbug-mshta-adobe-hta | Good |
| T1176 / T1112 | PDF Viewer sideload + native-messaging persistence | Q3, Q4 | ioa-jewelbug-runedge-native-messaging | Good — manifest-write itself is native-log only (Q5, §7), not Falcon-visible |
| T1555.003 / T1185 | In-browser cookie/credential theft by the extension itself | — | — | GAP — no discrete Falcon event; install/persistence-time detection only |
| T1102.002 / T1071.001 | Antino Microsoft Graph API C2 | Q6 | — | Partial — requires tenant-specific tuning against legitimate Graph traffic |
| T1505.003 / T1189 | Webshell execution and watering-hole script injection | Q7 | — | Partial — Q7 covers the execution step; the template/script write itself is native-log only (Q8, §7), not Falcon-visible |
| T1071.001 | XG-Web WebSocket/HTTP check-in beaconing | Q9 | — | Partial — cadence-based hunt, needs baseline tuning per environment |
| T1583.001 | XG-Web CDN-mimicking C2 hostnames | Q10 | — | Partial — hunt-only, manual verification required per hit |
| T1204.002 / T1036.005 | ClientKing ELF drop and execution | Q11, Q12 | — | Good |
| T1053.003 / T1543.002 | ClientKing cron/systemd persistence | Q13 | ioa-jewelbug-cron-systemd-temppath | Good |
| T1071.004 / T1568 | ClientKing DNS-tunneling C2 channel | Q14 | — | Partial — volume-threshold hunt, tune to environment baseline |
| T1572 | ClientKing SOCKS pivoting into internal networks | — | — | GAP — not covered; consider a lateral-movement-focused follow-on pack |
| T1014 | ClientKing in-memory kernel-module rootkit | — | — | GAP — pair with auditd init_module/finit_module syscall auditing (§7) |
| T1556 | ClientKing malicious su/sudo authentication module | — | — | GAP — pair with PAM file-integrity monitoring (§7, Playbook 2 near-term) |
| T1583.001 / T1608.006 (fraud arm) | OKX/Binance lookalike-domain SEO poisoning | — | — | GAP — individual-targeting, not EDR-huntable; awareness track only (§14) |
Validation gates from §11 apply across the board: none of the above queries have been baselined against a live tenant as of this build (v0.1) — treat every CONF rating as pre-deployment until the 7-day benign-baseline pass is complete.
Hunt Summary Ticket
TITLE: Jewelbug / XG-Web — dual espionage + crypto-fraud platform
SEVERITY: High (nation-state APT; active watering-hole + browser-hijack capability)
SCOPE: Windows workstations (browser + Office fleet), webmail/hosting-tier
servers, Linux server/ARM64/router-adjacent fleet
HYPOTHESIS: Antino delivers a malicious "PDF Viewer" browser extension via a
com.microsoft.runedge native-messaging bridge; the same XG-Web panel
drives a webmail watering-hole (webshell + template injection) and
a Linux/router implant (ClientKing) with DNS-tunneling C2.
QUERIES: Q1-Q14 (see Section 8; Q5 and Q8 are native-log checks, not CQL — no
Falcon event covers those two writes); Custom IOA candidates: Q1, Q3, Q13
DO FIRST: Q3 (com.microsoft.runedge registration) -- zero known FP, single
most distinctive published artifact. Then Q1/Q2, Q7, Q11/Q12.
FINDINGS: No atomic IOCs published in any of 6 fetched sources as of
2026-08-15; pack ships behavioral detections + REPLACE_WITH_
placeholders only. See Section 4 and Section 10.
GAPS: In-browser credential/cookie theft (T1555.003), SOCKS pivoting
(T1572), in-memory kernel-module rootkit (T1014), PAM/su/sudo
tampering (T1556) -- no discrete Falcon event; pair with native
audit logging per Section 7.
ACTIONS: Deploy Playbook 1 (extension/native-messaging lockdown) this week;
run all Investigate-only queries through a 7-day benign baseline
before promoting; brief webmail-admin and government/telecom
staff on the fake-Adobe/Flash lure pattern.
OWNER: HuntPack
VERSION: v0.1 · 2026-08-15
Changelog
References
| Tier | Source | Used for | Access date |
|---|---|---|---|
| 1 · Primary vendor | SECURITY.COM — Broadcom Symantec & Carbon Black Threat Hunter Team, "Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side" | Primary basis for architecture, scale statistics, malware families, largest-operation detail, IOC table | 2026-08-15 |
| 2 · Press | The Hacker News, "China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud" | Corroboration; direct vendor quote on XG-Web | 2026-08-15 |
| 2 · Press | Dark Reading, "'Jewelbug' APT Balances State Espionage & Cryptocurrency Theft" RECONSTRUCTED | Corroboration; additional target-sector detail (US industrial/aerospace manufacturer) | 2026-08-15 (via search snippet — direct fetch returned HTTP 403) |
| 2 · Press | BleepingComputer, "Hackers breach govt webmail while running parallel crypto fraud" RECONSTRUCTED | Corroboration of the 15-tenant webmail watering hole | 2026-08-15 (via search snippet — direct fetch returned HTTP 403) |
| 2 · Press | Security Boulevard, "Jewelbug: A Single Control Panel for Cyberespionage and Fraud" | ClientKing build-count and XG-Web VirusTotal self-check cadence detail | 2026-08-15 |
| 2 · Press | TechNadu, "Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side" | Geographic connection-volume breakdown; sole source of the com.microsoft.runedge string | 2026-08-15 |
Independent research to locate the primary Broadcom/Symantec Threat Hunter Team report was performed via web search; the security.com URL above (source 1) is that primary report — no separate standalone PDF/whitepaper was located. All source snapshots are saved verbatim to Jewelbug-XGWeb-Hunt-sources/ alongside this file for provenance tracing.