Jewelbug
Also known as Earth Alux, REF7707, CL-STA-0049, Ink Dragon, LongNosedGoblin
Reports
4
First seen
May 5, 2026
Last seen
Aug 17, 2026
Motivation
Espionage
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Sectors
Top ATT&CK techniques
T1190 Exploit Public-Facing Application ×4T1555 Credentials from Password Stores ×3T1566 Phishing ×3T1041 Exfiltration Over C2 Channel ×2T1027 Obfuscated Files or Information ×2T1083 File and Directory Discovery ×1T1056 Input Capture ×1T1583.001 Acquire Infrastructure: Domains ×1T1040 Network Sniffing ×1T1176 Browser Extensions ×1T1592 Gather Victim Host Information ×1T1204.001 User Execution: Malicious Link ×1
Indicators
filename ×40hash_sha256 ×20url ×11ip_v4 ×8domain ×7cve ×5
Indicator values are available on Pro and via the API.
Associated CVEs
Recent reports
High