JadeProx deploys TriBack Loader in government and healthcare attacks

Group-IB uncovered an exposed Alibaba Cloud server tied to JadeProx, a China-nexus cluster targeting government, healthcare and education organizations across Asia and Latin America. The server, found in mid-April 2026 in Alibaba Cloud’s Singapore region and offline by July 23, 2026, contained bash history, phishing packages, post-exploitation tools and webshell paths tied to activity against a Vietnamese public hospital, Malaysia’s Ministry of Foreign Affairs, Hong Kong education infrastructure and a spear-phishing package for the National Congress of Honduras.

The operation used TriBack Loader, a previously undocumented Windows loader, in four DLL sideloading chains. Recovered builds paired signed executables with malicious DLLs and encrypted .dat or .log payloads, then ran shellcode through less closely watched Win32 calls. Two variants delivered AdaptixC2, while a Claude-themed chain used DonutLoader to run Beagle and installed persistence through the Windows Startup folder after a UAC prompt.

JadeProx also ran Nuclei with critical-severity templates against 14,653 Hong Kong education-related URLs and found 13 unique vulnerabilities. Group-IB reported attempts against CVE-2018-11511, CVE-2021-24139, CVE-2021-31755 and CVE-2021-32305, each with a CVSS base score of 9.8.

Detection guidance centers on the sideloading pattern rather than fixed filenames, since signed host binaries changed across builds. Defenders were advised to flag vendor binaries running from user-writable, temporary or Startup directories with nearby encrypted .dat or .log files, and to prioritize exposed Java applications and public-facing systems with unpatched 9.8-rated flaws.