APT Explorer

All actors

REF7707

Also reported as CL-STA-0049 and Jewelbug. Linked to China by two sources.

Reports
8
Last reported
Known CVEs
5
Origin
China
ID
ref7707
Sources
MISPMalpedia
Merge evidence
3 alias matches

Reports per quarter

Dated reports, 2025 Q1 to 2026 Q2.

Techniques seen in the last two years

Show all 38 techniques Show fewer

Counts come from technique IDs in the actor's report text.

CVEs named in reports

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side

    Malpedia library date ORKL

    Archived copy on ORKL Details

  2. UAT-8302 and its box full of malware

    Malpedia library date ORKL

    Archived copy on ORKL Details

  3. Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  4. Anomali Cyber Watch: F5 Breach, Mysterious Elephant APT, Malicious MCP Servers, and More

    Malpedia library date ORKL

    Archived copy on ORKL Details

  5. Jewelbug: Chinese APT Group Widens Reach to Russia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  6. Squidoor: Suspected Chinese Threat Actor’s Backdoor Targets Global Organizations

    Malpedia library date ORKL

    Archived copy on ORKL Details

  7. From South America to Southeast Asia: The Fragile Web of REF7707

    Malpedia library date ORKL

    Archived copy on ORKL Details

  8. You've Got Malware: FINALDRAFT Hides in Your Drafts

    Malpedia library date ORKL

    Archived copy on ORKL Details

Newest first. Details opens the report in Explore.