[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLIi4ddq4Jz3BrOCQSDPcP8kylA4TqhYPEwOekVoqeps":3},{"article":4,"iocs":53,"watch_terms":73,"solutions":74,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"366b9d36-5f8f-481f-a4f5-6e9d35d2dca6","Hackers breach govt webmail while running parallel crypto fraud","hackers-breach-govt-webmail-while-running-parallel-crypto-fraud-209727","The Jewelbug hacker group has been carrying out espionage operations targeting governments and militaries while also engaging in cryptocurrency fraud. [...]","The Jewelbug hacker group, also known as Earth Alux and REF7707, has been simultaneously conducting espionage operations against governments and militaries while also engaging in large-scale cryptocurrency fraud. Researchers discovered that both activities were managed from the same control panel, indicating a potential hack-for-hire model. The group compromised webmail accounts of 15 government tenants in the Middle East, deploying a malicious script that exfiltrated cookies and credentials, and installed the Antino backdoor and browser tooling.","Jewelbug hackers conduct espionage and crypto fraud using same infrastructure.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-breach-govt-webmail-while-running-parallel-crypto-fraud\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F08\u002F13\u002Fhacker.jpg","2026-08-13T18:15:19+00:00","2026-08-13T20:00:17.578363+00:00",8,[17,20,22,24,27],{"name":18,"type":19},"Jewelbug","threat_actor",{"name":21,"type":19},"Earth Alux",{"name":23,"type":19},"REF7707",{"name":25,"type":26},"Adobe Flash","product",{"name":28,"type":29},"XG-Web","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,57,60,64,67,70],{"type":47,"value":55,"context":56},"Antino","Main payload installed on Windows systems.",{"type":47,"value":58,"context":59},"PDF Viewer","Malicious browser extension for Chrome and Firefox.",{"type":61,"value":62,"context":63},"mitre_attack","T1189","Drive-by Compromise (used for fake Adobe Flash update prompt)",{"type":61,"value":65,"context":66},"T1059.007","JavaScript (used for malicious script injection)",{"type":61,"value":68,"context":69},"T1571","Non-Standard Port (implied by WebSocket connection to C2)",{"type":61,"value":71,"context":72},"T1041","Exfiltration Over C2 Channel (implied by WebSocket connection and cookie exfiltration)",[25],{"controls":75,"vendors":160},[76,105,131],{"slug":77,"name":78,"problem":79,"products":80},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":106,"name":107,"problem":108,"products":109},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[110,118,123],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":119,"product_name":120,"url":121,"description":122},"managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":132,"name":133,"problem":134,"products":135},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[136,144,152],{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":153,"vendor_name":154,"vendor_logo":155,"product_slug":156,"product_name":157,"url":158,"description":159},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",[],{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":179},"jewelbug-group-compromises-government-webmail-via-cookie-theft-and-backdoor-implants","Jewelbug Group Compromises Government Webmail via Cookie Theft and Backdoor Implants","The Jewelbug\u002FEarth Alux group exploited government webmail systems by injecting malicious scripts that harvested session cookies and credentials, allowing persistent access across 15 tenants without needing repeated authentication. The use of a shared command-and-control panel for both espionage and cryptocurrency fraud highlights the sophistication and dual-purpose nature of modern threat actors operating in a hack-for-hire model. Cookie theft is particularly dangerous because it bypasses password protections entirely, including in some MFA configurations, making session token security a critical but often overlooked control. This incident underscores that government webmail systems, often treated as low-risk productivity tools, are high-value targets that require the same hardening as core infrastructure.",[166,167,168,169,170,171,172,173,174,175,176,177,178],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-12: Session Termination","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AU-6: Audit Record Review and Reporting","NIST SP 800-53 SC-7: Boundary Protection","NIST CSF DE.CM-1: Network Monitoring","GDPR Article 32: Security of Processing","MITRE ATT&CK T1539: Steal Web Session Cookie","MITRE ATT&CK T1185: Browser Session Hijacking","ITIL: Incident Management and Continuous Improvement",{}]