REF7707Threat actor
- CL-STA-0049
- Jewelbug
REF7707 is a cyber campaign targeting government entities, particularly a foreign ministry in South America, utilizing malware families such as FinalDraft, GuidLoader, and PathLoader for persistence and lateral movement. The threat actor employs the Microsoft Graph API for C2 communication, blending malicious traffic with legitimate activity to evade detection.From MISP Galaxy
Last reported 22 days ago, by The Hacker News11 reports
ATT&CK techniques
6 of 23 · each with the sentence it comes from- T1684Social Engineering
“"Another social engineering technique used for initial access in this campaign was the closely replicated reconstruction of Gmail's native attachment preview widget inside the email HTML body," Shen explained.”
- T1036Masquerading
“Masquerading: Match Legitimate Name or Location”
- T1053.005Scheduled Task
“Persistence was achieved using a Scheduled Task that invoked the renamed CDB.exe debugger and the weaponized INI file every minute as SYSTEM.”
- T1059.003Windows Command Shell
“The cmd and powershell commands allow the operator to execute commands directly through the Windows command shell or PowerShell and collect their output.”
- T1505.003Web Shell
“Researchers found the actor typically gained access through vulnerable IIS and SharePoint servers before deploying web shells and a sophisticated backdoor tracked as VARGEIT, Squidoor or FinalDraft.”
- T1550.002Pass the Hash
“Pass-the-Hash toolkit (pnt.x64.dll)”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
11 reports, newest first · the exact sentence from each-
Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign“UAT-11587 is assessed to share some level of overlap with Jewelbug, which, in turn, exhibits tactical similarities with China-aligned clusters known as CL-STA-0049, Earth Alux, Ink Dragon, and REF7707.”
-
China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor“While this report was being prepared, Symantec published research on an activity set it tracks as Jewelbug.”
-
Risky Bulletin: Intel ends paid bug bounties“Jewelbug: Back in August, Broadcom published a report on a Chinese APT that was running its espionage and crypto fraud from the same backend panel.”
-
August 2026 Threat Trend Report on APT Groups“Mustang Panda used hydropower-themed lures along with the Claimloader, ToneShell v10, and Havencode backdoors, while Earth Alux (Jewelbug) utilized XG-Web, Antino, PDF Viewer, and ClientKing for both espionage activity and cryptocurrency scams.”
-
17th August – Threat Intelligence Report“Researchers revealed a China-linked Jewelbug campaign using XG-Web to conduct espionage against government and military organizations while supporting cryptocurrency fraud.”
-
Researchers Link 'Jewelbug' Chinese APT to Hack-for-Hire Operations“Researchers Link 'Jewelbug' Chinese APT to Hack-for-Hire Operations”
-
Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia“This intrusion set has some network overlaps with CL-STA-0049 by Unit 42 and REF7707 by Elastic, two other intrusion sets that also have overlaps with Earth Alux (we examine these links in the “Attribution” section).”
-
NANOREMOTE, cousin of FINALDRAFT“The fully-featured backdoor we call NANOREMOTE shares characteristics with malware described in REF7707 and is similar to the FINALDRAFT implant.”
-
What the 2025 Elastic Global Threat Report reveals about the evolving threat landscape“REF7707, a threat campaign involving the FINALDRAFT, PATHLOADER, and GUIDLOADER malware families, provides details about how an espionage-motivated threat evaded defenses using Microsoft’s GraphAPI for C2.”
-
From South America to Southeast Asia: The Fragile Web of REF7707“From South America to Southeast Asia: The Fragile Web of REF7707”
-
You've Got Malware: FINALDRAFT Hides in Your Drafts“While investigating REF7707, Elastic Security Labs discovered a new family of previously unknown malware that leverages Outlook as a communication channel via the Microsoft Graph API.”
Indicators in its reports
named in the reports above- poster.checkponit[.]comin 2 reports
- support.fortineat[.]comin 2 reports
- support.vmphere[.]comin 2 reports
- update.hobiter[.]comin 2 reports
- checkponit[.]comin 2 reports
- 9a11d6fcf76583f7…f6f959853bcfin 2 reports
- 39e85de1b1121dc3…0c833e059530in 2 reports
- 83406905710e52f6…1fdb2d28cc8cin 2 reports
- rsproxy[.]cnin 2 reports
- d32tpl7xt7175h.cloudfront[.]netin 2 reports
Copy these 10 indicators · defanged
Thanks — we review every report.