DEV Community

Anoymask
Anoymask

Posted on

Jewelbug: XG-Web Infrastructure Supporting Government Webmail Compromise and Browser Takeover

#security #threatintel

Jewelbug: XG-Web Infrastructure Supporting Government Webmail Compromise and Browser Takeover

1. Basic Information

2. Executive Summary

Jewelbug injected JavaScript into government webmails on a shared hosting provider. This stole cookies and pushed fake Flash updates, deploying Antino, malicious browser extensions, Linux/router ClientKing implants, and rootkits. The group also used the same XG-Web infrastructure for cryptocurrency fraud.

3. Attack Flow

From Government Webmail to Windows Devices

  1. The attackers insert a common malicious script tag into more than 15 government webmail tenants on a shared hosting provider.
  2. When users log in or view their mailboxes, the script opens a WebSocket, completes a crypto handshake, and sends page cookies.
  3. It shows a fake Adobe Flash update to devices that match the target government domain, are uninfected, and run Windows.
  4. When a user runs the file, a fake Adobe installer or HTA deploys Antino.
  5. Antino uses the Microsoft Graph API as a C2 channel to sideload a malicious "PDF Viewer" extension and a native messaging helper.
  6. The extension steals cookies, history, bookmarks, screenshots, clipboard data, and network traffic, and injects arbitrary JavaScript.
  7. The native helper runs commands via the Windows command interpreter.
  8. The attackers also access internal virtualization management APIs from the compromised device.

Deploying ClientKing to Linux and Routers

  1. The malware fetches a new random-XOR payload from Google Docs for each request.
  2. It deploys the Rust-based ClientKing to Linux, ARM64, and ASUS routers.
  3. It uses five types of C2 transport, including HTTP and DNS tunneling.
  4. It provides a shell, a SOCKS proxy, and an in-memory kernel module.
  5. A companion kernel rootkit and a malicious authentication module steal credentials for SSH, su, and sudo.

Cryptocurrency Fraud

  1. The attackers create many AI-generated fake exchange pages that mimic OKX, Binance, and others.
  2. They drive visitors to these sites using click bots and SEO poisoning.
  3. They manage the scam sites using the same XG-Web control panel and infrastructure.

4. Attacker Locations and Execution Sites

  • The injected JavaScript and the XG-Web management infrastructure are on the attacker's side. The initial execution happens inside the victim webmail user's browser.
  • Antino, the extension, and the native helper run on Windows devices.
  • ClientKing, the rootkit, and the authentication module run on Linux, ARM64, and ASUS routers.
  • The infrastructure is the same, but public sources do not confirm the organizational relationship between the espionage team and the crypto fraud team.

5. Visibility for Victims and Administrators

  • Webmail users see an overlay that looks like a Flash update after a normal login.
  • Administrators can see common external scripts, WebSockets, cookie exfiltration, HTA or installer files, extension sideloading, and Graph API traffic.
  • On Linux and routers, they can see Google Docs requests, DNS tunneling, SOCKS traffic, unknown Rust binaries, kernel modules, and SSH authentication hooks.
  • Because the attack uses legitimate services like the Graph API, Google Docs, browser extensions, and shared hosting, simple domain allowlists cannot easily detect it.

6. Success and Failure Conditions

Success Conditions

  • The attackers successfully compromise a shared host to inject scripts into webmail templates.
  • Target users access the site on Windows and run the fake update.
  • The environment allows extension sideloading, native messaging, Graph API, Google Docs, and DNS egress.
  • The attackers have permissions to load implants and modules on Linux and routers.

Failure Conditions

  • Webmail template integrity monitoring removes the common script.
  • Users do not run the Flash update requested by the web page.
  • The organization blocks unauthorized extensions, native messaging hosts, and HTAs.
  • Security tools correlate and block Graph API, Google Docs, and DNS destinations along with device behavior.
  • Kernel module allowlists, Secure Boot, and router rebuilds eliminate ClientKing and rootkits.

7. What Happens Upon Success

Webmail cookies, email bodies, browser cookies, credentials, screenshots, clipboard data, and browsing history are stolen. Attackers gain the ability to run arbitrary commands on the device, relay SOCKS traffic, and explore internal management planes. On the crypto fraud side, victims are directed to fake exchanges and lose funds.

8. Observable Logs

  • Email: External scripts in webmail, email body access, and abnormal mailbox viewing.
  • Proxy/SWG/DNS: fonts.chrorne[.]com, WebSockets, Microsoft Graph, Google Docs, DNS tunneling, and fake exchange sites.
  • Endpoint/EDR: HTA files, fake Adobe installers, Antino, unauthorized PDF Viewer extensions, native helpers, Chrome native messaging registry keys, Rust binaries, and kernel modules.
  • Identity/IdP: Session reuse from new IP addresses or devices using stolen cookies, and mailbox access without authentication.
  • SaaS/Cloud: Microsoft Graph API calls, Google Docs payload downloads, and template changes in webmail tenants.
  • Network: SOCKS traffic, DNS tunneling, and internal access to https://192.168.x.x:8006/api2/json/cluster/resources.

9. Attack Success Determination

  • Contact Only: Malicious script loaded, overlay displayed.
  • User Action: Fake update downloaded or HTA executed.
  • Initial Execution: Antino, extension, and native helper created and started.
  • Authentication/Session Compromise: Cookies sent, and a different IP address uses those cookies for a session.
  • Data Theft: Cookies, credentials, or email bodies seen in C2 or management panels, or equivalent egress traffic confirmed.
  • Lateral Expansion: ClientKing, rootkit, SOCKS traffic, or internal virtualization API connections confirmed.

10. Investigation Playbook

  • Trigger: External script in webmail templates, chrorne domain, Graph C2, unauthorized extensions, or DNS tunneling.
  • Initial Verification: Identify affected tenants, template differences, script load times, target users, and cookie lifetimes.
  • Endpoints: Preserve downloads, HTAs, extension IDs/manifests, native messaging registry keys, Antino, ClientKing, modules, and shell history.
  • Authentication and Cloud: Revoke webmail and IdP sessions, and check Graph/Google Docs access, mailbox operations, and shared host admin changes.
  • Subsequent Operations: Search for internal virtualization management API access, SOCKS traffic, DNS tunneling, and stolen SSH/su/sudo credentials.
  • Containment: Repair templates, revoke sessions, change credentials, remove extensions and native hosts, rebuild infected Linux systems and routers, and block IOCs.
  • Decision Categories: Script Injected / User Exposed / Payload Executed / Session Stolen / Endpoint Controlled / Internal Expansion Confirmed.

11. Defense and Detection Ideas

  • Single Event: chrorne[.]com, unauthorized native messaging host, Flash update HTA, or unknown process communication with the Graph API.
  • Timeline Correlation: Webmail script -> cookie egress -> fake update -> HTA -> Antino -> extension -> Graph C2 -> internal API.
  • Hunting: Identical scripts across more than 15 tenants, com.microsoft.runedge registry keys, changing payloads from Google Docs, DNS tunneling, and ClientKing Rust builds.
  • Log Gaps: Webmail templates, browser extensions, Graph requests, and router/kernel telemetry are often missing.
  • Priority Measures: Isolate shared hosting, implement CSP/SRI, use extension allowlists, control native messaging, shorten session lifetimes, monitor DNS, and establish secure network device rebuild procedures.

12. Facts / Inference / Hypothesis

Facts

  • A common script tag was found in more than 15 government webmail tenants.
  • WebSockets were used to steal cookies and distribute Antino via fake Flash updates.
  • Antino used Microsoft Graph C2, malicious extensions, and native helpers.
  • ClientKing has 37 builds for Linux, ARM64, and ASUS routers, along with 5 C2 transports.
  • The management infrastructure recorded over 1 million check-ins, over 580,000 cookies, thousands of credentials, and more than 2,300 email bodies.
  • The same XG-Web infrastructure was used for both espionage and cryptocurrency fraud.

Inference

  • A single compromise of shared hosting provided a cross-tenant distribution point for multiple government targets.
  • Detection must focus on calling processes and API purposes, not just allowing or blocking SaaS traffic.

Hypothesis

  • The cryptocurrency fraud side most likely supplied access, infrastructure, and distribution capabilities to the espionage side, but the command relationship between the two remains unconfirmed.
  • Clipboard replacement for cryptocurrency addresses is implemented, but its use has not been confirmed in public espionage campaigns.

13. MITRE ATT&CK Mapping

  • High Confidence: T1189 Drive-by Compromise, T1056 Input Capture, T1539 Steal Web Session Cookie, T1176 Browser Extensions, T1059.003 Windows Command Shell, T1102.002 Bidirectional Communication, T1102.003 One-Way Communication, T1071.004 DNS, T1090 Proxy, T1014 Rootkit, T1556 Modify Authentication Process.
  • Medium Confidence: T1204.002 Malicious File, T1218.005 Mshta, T1021 Remote Services, T1041 Exfiltration Over C2 Channel.

14. Unknowns and Further Investigation

  • Initial access vector to the webmail shared hosting environment.
  • Complete list of victim organizations and countries, and actual damage from each artifact.
  • Contractual and command relationships between Jewelbug subgroups and registered companies in Hunan Province.
  • Direct targeting of Japanese-language fake exchanges or organizations in Japan.
  • Privilege escalation paths when deploying ClientKing and rootkits.

15. Impact on Global SOCs and Organizations

This campaign poses high relevance to organizations in government, telecommunications, aviation, defense, and cryptocurrency sectors. In environments where Microsoft Graph and Google Docs cannot be fully blocked, organizations must correlate telemetry across browser extensions, native helpers, DNS, and internal management APIs. Network devices, including ASUS routers, cannot be monitored using endpoint EDR agents alone.

16. Summary by Target Audience

  • For SOC Analysts: Track webmail scripts, sessions, extensions, Graph API traffic, and DNS tunneling as a single attack chain.
  • For Administrators: Maintain template integrity, enforce CSP, manage extension and native messaging allowlists, revoke sessions, and prepare router rebuild procedures.
  • For Users: Do not run Flash or PDF updates requested by webmail pages, and report unexpected browser extensions.

Top comments (0)