China-Nexus JadeProx Deploys New TriBack Loader in Attacks on Government and Healthcare

Group-IB has uncovered a China-nexus cyber operation tracked as JadeProx, which has been targeting government, healthcare, and education organizations across Asia and Latin America. The operation uses a previously undocumented Windows loader called TriBack Loader, discovered on an exposed Alibaba Cloud server in the Singapore region in mid-April 2026.

The server’s bash history, phishing packages, post-exploitation tools, and webshell paths revealed active intrusions against a Vietnamese public hospital’s medical imaging system and Malaysia’s Ministry of Foreign Affairs, as well as scanning and exploitation follow-up against Hong Kong education infrastructure. A spear-phishing package was also addressed to the National Congress of Honduras.

TriBack Loader appears in four infection chains built around DLL sideloading. Most recovered builds pair a legitimate signed executable with a malicious DLL and an encrypted .dat or .log payload. The DLL reverses the payload bytes, XORs them with a rolling key, and executes shellcode through Win32 calls such as InitOnceExecuteOnce, TimerQueue callback, and EtwpCreateEtwThread. Two variants delivered AdaptixC2, an open-source post-exploitation framework. A Claude-themed variant used DonutLoader to run the Beagle backdoor. The fourth variant’s payload is unknown.

One spear-phishing archive carried a fake beverage-company account statement as the decoy. Another campaign impersonated Anthropic’s Claude software from claude-pro[.]com, serving a malicious MSI installer that placed the sideloading chain in the Windows Startup folder for persistence. The Beagle backdoor it delivered reported to license[.]claude-pro[.]com.

The operators also ran Nuclei with critical-severity templates against a list of 14,653 Hong Kong education-related URLs, surfacing 13 unique vulnerabilities. The report names four CVEs: CVE-2018-11511 (ASUSTOR ADM), CVE-2021-24139 (10Web Photo Gallery WordPress plugin), CVE-2021-31755 (Tenda AC11 routers), and CVE-2021-32305 (WebSVN), each with a CVSS base score of 9.8. The Tenda bug has been on CISA’s Known Exploited Vulnerabilities catalog since November 3, 2021.

Detection focuses on the sideloading chain: flag signed vendor binaries running from user-writable, temporary, or Startup directories, especially when an encrypted .dat or .log file sits in the same folder. Look for unexpected copies of hostfxr.dll, avk.dll, or MpClient.dll, plus nested _CL_###### folders and ~del.vbs.bat. Block or investigate the cluster’s domains: claude-pro[.]com, license[.]claude-pro[.]com, sylverixstrategy[.]com, gouvvbo[.]top, vertextrust-advisors[.]com, update-trellix[.]com, update-crowdstrike[.]com, and update-sentinelone[.]com. The staging server was 43.106.71[.]28 on port 8000.