JadeProx: Chinese Group Targets Government Bodies and Hospitals with New TriBack Loader

Group-IB has published a report on a China-linked operation it tracks under the name JadeProx. The investigation began with an unsecured server in Alibaba Cloud's Singapore region, discovered in mid-April 2026; by the time the report was published on July 23, it had already been taken offline.

The server's contents — bash command history, phishing kits, post-exploitation tools and paths to web shells — effectively laid the operation out piece by piece. Among the targets: the medical imaging system of a Vietnamese state hospital, Malaysia's Ministry of Foreign Affairs, Hong Kong's educational infrastructure, and a phishing kit aimed at the National Congress of Honduras. The attackers broke into the hospital through web shells planted on an exposed Java management interface.

One Loader, Four Builds

TriBack Loader appears across four infection chains built on DLL sideloading. Typically, a legitimate signed executable is accompanied by a malicious library and an encrypted .dat or .log file. The DLL reverses the payload's bytes, applies XOR with a rolling key, and launches shellcode through API calls that EDR monitors less closely than CreateThread. The final call changes from build to build — from InitOnceExecuteOnce and a TimerQueue callback to the undocumented EtwpCreateEtwThread function in ntdll. The recurring call sequence, researchers believe, points to a homegrown loader builder.

Two builds delivered the open-source AdaptixC2 framework, while another launched the Beagle backdoor via DonutLoader. A separate campaign masqueraded as Anthropic's Claude software: the site claude-pro[.]com, registered on March 28, 2026, served a malicious MSI installer that, after a UAC prompt, established persistence in the Windows startup folder.

Loader Engineering Against a Backdrop of Old Vulnerabilities

A curious contrast: for all the sophistication of the loader itself, the scanning side of the operation relied on vulnerabilities from 2018 and 2021. The operators ran Nuclei with critical-severity templates only against a list of 14,653 URLs of Hong Kong educational resources, uncovering 13 unique flaws. The report names four CVEs used against individual hosts — in ASUSTOR ADM, the 10Web Photo Gallery plugin for WordPress, Tenda AC11 routers, and WebSVN — all with a base CVSS score of 9.8. The Tenda flaw has been listed in CISA's Known Exploited Vulnerabilities catalog since November 2021.

Group-IB refrains from attributing the activity to any specific known group: tools in the Chinese cyber ecosystem flow freely between operators, so a match in tooling is not equivalent to a match in perpetrators. Sophos, which independently studied the fake Claude site, found the same reused XOR key in builds dating back to February, but likewise declined to draw a definitive conclusion.

For defense, the primary recommendations are to close off internet-facing Java applications and systems with unpatched 9.8-level vulnerabilities, and to monitor signed vendor binaries launched from user, temporary or startup folders — especially when an encrypted .dat or .log file sits alongside them.

Source: The Hacker News