China-Linked JadeProx Uses TriBack Loader in Multi-Region Attacks
Group-IB researchers have exposed a China-nexus threat cluster tracked as JadeProx after discovering an unprotected Alibaba Cloud server in the Singapore region in mid-April 2026. The server, taken offline by the time Group-IB published its report on July 23, 2026, contained bash history files, phishing packages, post-exploitation tooling, and webshell paths that mapped out active intrusions against a Vietnamese public hospital's medical imaging system, Malaysia's Ministry of Foreign Affairs, and Hong Kong education infrastructure. The operators also staged a spear-phishing package addressed to the National Congress of Honduras, confirming the campaign's reach across both Asia and Latin America. Intrusion into the Vietnamese hospital began through webshells planted on an exposed Java management interface, a reminder that unhardened administrative endpoints remain a reliable foothold for state-aligned operators—something defenders can verify with routine port scanning of their perimeter.
The centerpiece of the operation is TriBack Loader, a previously undocumented Windows loader delivered through four infection chains built on DLL sideloading. Most variants pair a legitimately signed executable with a malicious DLL and an encrypted .dat or .log payload. The DLL reverses the payload bytes, XORs them with a rolling key, and injects shellcode via less-monitored Win32 calls, including InitOnceExecuteOnce, a TimerQueue callback, and the undocumented EtwpCreateEtwThread routine in ntdll. The signed host binary rotated across builds, and the repeated API sequence points to a custom loader builder rather than handcrafted artifacts. Two of the four variants deployed AdaptixC2, an open-source post-exploitation framework, while a Claude-themed variant used DonutLoader to deliver Beagle, a backdoor Sophos first documented.
The Claude-themed campaign impersonated Anthropic software from the domain claude-pro[.]com, registered on March 28, 2026, and served a malicious MSI installer that bypassed a UAC prompt to drop the sideloading chain into the Windows Startup folder for persistence. The Beagle backdoor called home to license[.]claude-pro[.]com, and the same reused XOR key appeared in builds dating back to February 2026. A separate spear-phishing archive carried a fake beverage-company account statement as its decoy document. Investigators can pivot from domains like these using a WHOIS lookup to trace registration metadata, while the underlying hosting infrastructure can be examined with an SSL/TLS checker to surface certificate reuse across malicious properties.
Beyond initial access, JadeProx operators ran the Nuclei scanner with critical-severity templates against a curated list of 14,653 Hong Kong education-related URLs, surfacing 13 unique vulnerabilities for follow-on exploitation. Group-IB stopped short of attributing the cluster to any established named group, noting that tooling moves freely within the China-nexus ecosystem and that a match on tools is not a match on operators. Sophos, which independently analyzed the fake Claude site and shared infrastructure, reached a similar conclusion despite observing the reused XOR key, underscoring how shared loaders and commodity frameworks continue to blur traditional actor boundaries.