Chinese APT Group IT Service Provider Leveraging Microsoft Console Debugger to Exfiltrate Data
In early 2025, the Chinese APT group known as Jewelbug initiated a campaign targeting an IT service provider in Russia. This campaign involved infiltration of build systems and code repositories, which set the stage for a potential software supply chain…
In early 2025, the Chinese APT group known as Jewelbug initiated a campaign targeting an IT service provider in Russia. This campaign involved infiltration of build systems and code repositories, which set the stage for a potential software supply chain compromise.
The attackers gained initial access through a renamed Microsoft Console Debugger binary, "7zup.exe," which executed shellcode and bypassed application whitelisting. This method allowed the adversary to maintain a network presence from January through May 2025. Symantec analysts observed that the use of a signed Microsoft binary for malicious purposes is indicative of living-off-the-land tactics.
By renaming cdb[.]exe and leveraging its debugging capabilities, attackers could launch executables, run arbitrary DLLs, and terminate security processes without triggering immediate alarms.
Following the initial compromise, activities included credential dumping, privilege elevation via scheduled tasks, and clearing of Windows Event Logs to conceal their actions. Data exfiltration was conducted through Yandex Cloud, a legitimate Russian service. The attackers utilized a custom payload, "yandex2.exe," to automate the upload of sensitive files, leveraging the cloud platform's credibility to blend in with regular traffic.
In early 2025, the Chinese APT group known as Jewelbug initiated a campaign targeting an IT service provider in Russia.
The campaign targeted high-value assets on build servers, indicating an espionage-driven objective focused on source code and proprietary software updates. Further post-compromise actions included the creation of persistent scheduled tasks and manipulation of registry settings to disable security restrictions. Lateral movement attempts were made using tools like Mimikatz for LSASS memory dumping and Fast Reverse Proxy for exposing internal servers to the internet.
The initial compromise involved a Microsoft-signed binary. The attackers deployed the renamed Console Debugger executable into the user profile directory and invoked it with the command:
C:\Users\Public\7zup.exe -c ".shellcode 0x1000,LoadShellcode; g;"
This command injected shellcode directly into memory, bypassing signature checks and application whitelisting. By chaining debugger commands, the malware allocated executable memory regions, loaded encrypted payloads, and transferred execution to malicious code. This injection technique enabled Jewelbug to establish a foothold for subsequent credential harvesting and data extraction.
The reliance on dual-use tools like cdb[.]exe and legitimate cloud channels highlights the group's sophisticated evasion methods and long-term espionage objectives.
Based on reporting by Cyber Security News.