REF7707
No sourced public emblem in this profile.
reference profile · reported nexus: CN (not nationality)
REF7707 is a cyber campaign targeting government entities, particularly a foreign ministry in South America, utilizing malware families such as FinalDraft, GuidLoader, and PathLoader for persistence and lateral movement. The threat actor employs the Microsoft Graph API for C2 communication, blending malicious traffic with legitimate activity to evade detection. Despite their technical sophistication, REF7707 operators exhibited poor operational security, leading to the exposure of their infrastructure and malware. Their tactics enable the extraction of sensitive data, including passwords and Active Directory information, facilitating ongoing espionage activities.
Source-reported aliases: CL-STA-0049, Jewelbug. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://unit42.paloaltonetworks.com/advanced-backdoor-squidoor/
https://www.elastic.co/security-labs/fragile-web-ref7707
https://www.security.com/threat-intelligence/jewelbug-apt-russia
https://www.security.com/threat-intelligence/jewelbug-crypto-fraud-espionage