What other aliases and vendor names is REF7707 known by?

REF7707 is tracked across the cybersecurity industry by multiple aliases, including: CL-STA-0049, Ink Dragon, Jewelbug, LongNosedGoblin, UAT-8302.

REF7707

Q: What are the primary motivations and sponsors of REF7707?

REF7707 operates from China with primary motivation categorized as Cyber-espionage and financial gain (cryptocurrency fraud), sponsored or affiliated with People's Republic of China (PRC).

ACTIVE CAMPAIGN TRACKED ⚠ Critical Threat China

Primary Aliases: CL-STA-0049 Ink Dragon Jewelbug LongNosedGoblin

Sponsor / State Affiliation People's Republic of China (PRC)

Primary Motivation Cyber-espionage and financial gain (cryptocurrency fraud)

Active Timeline Unknown – Present

Confidence Rating 95% (Grounded)

Russian IT Service Provider Intrusion, South American Foreign Ministry Espionage, Southeastern European Government Targeting

⚔️ Weaponized CVE Matrix (0)

No specific weaponized CVEs currently mapped in the public baseline.

🎯 Target Sectors & Focus

Government Ministries Defense Telecommunications Aviation Education IT Service Providers Critical Infrastructure

🛡️ MITRE ATT&CK® Attack Lifecycle (9 TTPs)

📥 Download Navigator JSON

Initial Access 1

T1566 Watering hole attacks on government webmail tenants

↗

Persistence & Privilege Escalation 1

T1547 Web shell deployment (e.g., OutlookDC.aspx, TimeoutAPI.aspx)

↗

Defense Evasion 1

T1027 BYOVD (Bring Your Own Vulnerable Driver) using EchoDrv to disable security software

↗

Command & Control 2

T1071 Abuse of cloud APIs for C2 (Microsoft Graph API, Google Drive API)

↗

T1071 Deployment of modular backdoors (FinalDraft/Squidoor, NanoRemote, Antino)

↗

Operational Techniques 4

T1000 Exploitation of IIS/SharePoint vulnerabilities (ViewState deserialization)

↗

T1000 Use of renamed legitimate binaries (e.g., cdb.exe renamed to 7zup.exe) to bypass whitelisting

↗

T1000 DLL Sideloading

↗

T1000 DNS and ICMP tunneling for covert communication

↗

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Jewelbug UAT-8302 APT: Dual-Mandate Espionage and Cryptocurrency Theft

Attacks and Vulnerabilities 2026-08-13

Copied to clipboard

LINK COPIED TO CLIPBOARD

REF7707

⚔️ Weaponized CVE Matrix (0)

🎯 Target Sectors & Focus

🛡️ MITRE ATT&CK® Attack Lifecycle (9 TTPs)

📰 Verified Campaigns & Intelligence Archive

SHARE INTELLIGENCE WIRE