China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud

The Jewelbug threat actor, linked to China, is conducting cyber espionage against governments and militaries, and also engaging in cryptocurrency fraud. These operations are managed from a single control panel using the XG-Web framework, which allows for remote access and information theft. XG-Web is a browser-centric framework that enables full remote control of a victim's browser. This framework is used to administer both the espionage and fraud activities. Jewelbug's use of XG-Web indicates a high level of sophistication in their operations. The threat actor's ability to manage multiple missions from a single control panel suggests a significant level of organization and planning.