REF7707
Aliases: CL-STA-0049, Jewelbug
- Origin
- CN
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- nation-state
- Last IoC activity
- 2026-07-22 00:32:52
- Profile updated
- 2026-07-07 12:21:04
Targeted industries: government-and-public-sector
Targeted regions: country_code:co
Context
REF7707 is a cyber campaign targeting government entities, particularly a foreign ministry in South America, utilizing malware families such as FinalDraft, GuidLoader, and PathLoader for persistence and lateral movement. The threat actor employs the Microsoft Graph API for C2 communication, blending malicious traffic with legitimate activity to evade detection. Despite their technical sophistication, REF7707 operators exhibited poor operational security, leading to the exposure of their infrastructure and malware. Their tactics enable the extraction of sensitive data, including passwords and Active Directory information, facilitating ongoing espionage activities.
Reports & references
- Palo Alto Unit 42 — Advanced Backdoor Squidoor (report)
- elastic.co — Fragile Web Ref7707 (report)
- security.com — Jewelbug Apt Russia (report)
- security.com — Jewelbug Crypto Fraud Espionage (report)