Chinese Hacking Group Exposes Dual Operations: Espionage and Crypto Fraud

A Chinese hacking group known as Jewelbug or Earth Alux has been found to be operating dual operations, one for espionage and another for cryptocurrency fraud. The threat actor targets foreign governments and militaries in Asia and the Middle East, as well as commits for-profit crypto theft from a single control panel with a victim database.

Symantec, a threat intelligence firm, discovered that hackers for hire are common in the Chinese cyber ecosystem, with many nation-states preferring to keep everything in-house. However, China's large-scale operations require contractors to meet capacity demands.

The group's commercial arm is tied to a registered company in Hunan province, which operates as a search-ranking rental provider but actually generates phishing pages using artificial intelligence tools. They use AI to create thousands of fake download pages impersonating cryptocurrency exchange platforms, supported by over 40 content-management servers and click-fraud bots.