JadeProx Used TriBack Loader Against a Vietnamese Hospital, Malaysia’s Foreign Ministry, and Hong Kong Schools
Do Son 
At a Glance
| Actor or group | JadeProx, a China-nexus cluster named by Group-IB; no known group named |
| Activity type | Espionage-style intrusions, phishing, credential harvesting, tunnelling |
| Targets | A Vietnamese public hospital, Malaysia’s foreign ministry, Hong Kong schools, plus Honduras and Venezuela lures |
| Scale | 14,653 URLs on one target list; four loader variants; no victim count or financial figure published |
| Law-enforcement status | No arrests or charges reported; the staging server is offline |
| Source | Group-IB threat research |
TL;DR
In mid-April 2026, an operator left a directory listing open on an Alibaba Cloud server. Group-IB walked in and found bash history, toolkits, webshell paths, and staged phishing packages from live intrusions. At the centre sits TriBack Loader, a custom shellcode loader that researchers saw across four separate infection chains.
What Happened
The mistake was simple. Someone left a Python HTTP server running with directory listing enabled, on a Singapore instance with an open SSH port. That single lapse exposed simultaneous operations across three countries.
Bash history told the story in order. Operators ran a modified Alibaba evasion script to blind the cloud provider’s monitoring agent. They pulled tunnelling tools straight from GitHub. Then they pivoted.
Three Intrusions, Three Techniques
Against a Vietnamese public hospital, the operators targeted the PACS medical imaging server. They planted webshells twice through an exposed Java management interface, then tunnelled through them.
Against Malaysia’s Ministry of Foreign Affairs, the first attempt failed. After some debugging and a missing dependency, a webshell went in on the second try.
Hong Kong got the automated treatment. A target list held 14,653 URLs across 117 service ports, clearly machine-generated given the duplicate entries. A vulnerability scanner running only critical-severity templates returned 13 unique findings. Follow-up exploitation used old CVSS 9.8 bugs, including CVE-2018-11511 and CVE-2021-24139, both SQL injection flaws in photo gallery software.
Fake Claude Software as a Lure
One variant took a different route. Operators built a phishing site impersonating Anthropic’s Claude, then served a ZIP archive and an MSI installer that looked like Claude software. The MSI ran in Chinese throughout its install sequence, despite being uploaded from the UK.
Other lures were regional. A Honduras decoy imitated an account statement from a major local brewery, addressed to the National Congress. A separate live portal impersonated a Venezuelan municipal tax system and collected identity documents from anyone who registered.
How TriBack Loader Works
Each chain follows the same shape. A signed, legitimate binary sideloads a malicious DLL, which decrypts an accompanying data file using byte reversal and a rolling XOR.
The clever part is execution. Rather than calling CreateThread, the loader hands its shellcode to a Windows callback API, and it rotates that API between builds. Researchers saw one-time initialization callbacks, timer queue callbacks, and an undocumented thread-creation routine pulled from ntdll. Each choice sidesteps hooks that endpoint products watch.
Two variants deliver AdaptixC2 beacons. A third drops a backdoor tracked as Beagle. Notably, two variants share an identical XOR key, which suggests one custom builder produced them all.
Who Is Behind It
Group-IB places this firmly in the China-nexus ecosystem, and the evidence is circumstantial but consistent. Chinese-origin tooling, a Chinese-language installer, Alibaba hosting, and a shared registrar all point the same way.
Specific group attribution is another matter, and researchers deliberately declined it. The signed-binary technique overlaps with documented Mustang Panda activity. The hands-on toolkit resembles Earth Lusca and UAT-5918 operations. A GitHub cookie in one beacon config echoes Tropic Trooper.
Yet Group-IB is blunt that “no single group accounts for the full picture.” The report also warns that “the presence of the same tools does not mean the same operator.” Hence the neutral JadeProx label.
Impact and Scale
No victim count exists, and no money changed hands in any published figure. The impact sits elsewhere. A hospital imaging system, a foreign ministry, and an education sector scanned at scale all represent long-dwell espionage value rather than immediate theft.
File timestamps place development back in January 2026. Four loader builds appeared across two months, so the operation was active well before anyone noticed.
What Comes Next
- Audit internet-facing Java management interfaces and PACS deployments for webshells.
- Patch the old critical CVEs that mass scanners still find, especially in web plugins and appliances.
- Alert on signed binaries loading DLLs from unusual directories, including startup folders.
- Treat downloads of AI tooling from unofficial domains as hostile.
- Hunt for tunnelling utilities and outbound SOCKS traffic from server subnets.
The staging server is gone. The builder, the loader family, and the infrastructure pattern are not, so expect fresh variants under new domains.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
