XG-WEBXG-Web

According to Symantec, XG-Web is the operator control panel of the Jewelbug (aka REF7707, Earth Alux, CL-STA-0049) group, administering both its espionage and cryptocurrency fraud operations. It is a browser-centric remote-access and information-stealing platform built as a React panel over a Node.js backend, with a MySQL database that doubles as the rendezvous point for victim implants. Its developers describe it as a penetration-testing platform, while internal terms for its functions include browser hijacking, data theft and man-in-the-middle attack. Campaign payloads were served through public Google Documents created by the backend, and a scheduled job checked the group's own C&C domains against VirusTotal every twelve hours so operators could rotate away from flagged infrastructure.