Group-IB has uncovered a China-nexus cyber operation tracked as JadeProx, which has been targeting government, healthcare, and education organizations across Asia and…
JadeProx is a China-nexus cyber operation tracked by Group-IB, targeting government, healthcare, and education organizations across Asia and Latin America. It uses…
TriBack Loader is a previously undocumented Windows loader used by the JadeProx operation. It employs DLL sideloading with four infection chains, using…
DonutLoader is a shellcode loader used in a Claude-themed variant of the JadeProx operation to deliver the Beagle backdoor.
Beagle is a backdoor first documented by Sophos, delivered via DonutLoader in a Claude-themed attack by the JadeProx operation. It communicates with…
Nuclei is a vulnerability scanner used by the JadeProx operation to scan 14,653 Hong Kong education-related URLs with critical-severity templates.