Key Takeaways
- An exposed Alibaba Cloud server in Singapore revealed the China‑nexus operation “JadeProx,” which targeted government, healthcare, and education entities across Asia and Latin America.
- The operators used a previously undocumented Windows loader called TriBack Loader, delivered via DLL sideloading in four distinct builds.
- Two builds dropped the open‑source AdaptixC2 framework; a Claude‑themed variant deployed the Beagle backdoor via DonutLoader; the fourth build’s payload remains unknown.
- Spear‑phishing lures impersonated a beverage‑company statement and a fake Claude software site (claude‑pro[.]com) to achieve persistence through the Windows Startup folder.
- Scanning activity leveraged Nuclei with critical‑severity templates against ~14,650 Hong Kong education URLs, uncovering 13 vulnerabilities; exploitation attempts focused on four high‑CVSS flaws (CVE‑‑‑11511, CVE‑‑V‑E‑2018‑11511, CVE‑2021‑24139, CVE‑2021‑31755, CVE‑2021‑32305).
- Detection hinges on spotting signed binaries executing from user‑writable locations alongside encrypted .dat/.log files, suspicious DLL copies, and specific malicious domains/IPs.
- Although tooling overlaps with known China‑nexus groups, Group‑IB refrains from attributing the activity to a specific threat actor due to the fluid sharing of utilities in the ecosystem.
Overview of the JadeProx Operation
In mid‑April 2026, researchers at Group‑IB discovered an exposed Alibaba Cloud instance hosted in the Singapore region. The server, which was taken offline before the public report on July 23 2026, contained a trove of artefacts—including bash histories, phishing kits, post‑exploitation tools, and webshell paths—that mapped out a coordinated intrusion campaign dubbed JadeProx. The operation exhibited a clear focus on high‑value targets: a Vietnamese public hospital’s medical imaging system, Malaysia’s Ministry of Foreign Affairs, Hong Kong education infrastructure, and the National Congress of Honduras. By planting webshells on an exposed Java management interface, the threat actors gained initial footholds inside the hospital’s imaging server and subsequently pivoted to other environments.
Infrastructure Exposure and Discovery
The compromised Alibaba Cloud server acted as a command‑and‑control hub and staging ground for the attackers. Its file system revealed directories housing multiple loader variants, encrypted payloads (.dat or .log files), and legitimate‑looking executables used for DLL sideloading. Bash history entries showed the operators routinely scanning target networks, deploying webshells, and executing post‑exploitation scripts. Phishing packages crafted to mimic trusted brands were also present, indicating a dual approach of network‑‑combining opportunistic vulnerability exploitation with socially engineered email attacks. The server’s exposure provided Group‑IB with a rare window into the attackers’ tooling, infrastructure, and tactical workflow.
TriBack Loader Architecture and Variants
TriBack Loader is a custom Windows loader that relies on DLL sideloading to execute malicious shellcode while evading detection. Four distinct builds were identified, each pairing a legitimate, signed executable with a malicious DLL and an encrypted payload file (.dat or .log). The DLL’s routine reverses the payload bytes, then XOR‑decrypts them with a rolling key before invoking the shellcode through Win32 APIs that are less scrutinized by endpoint detection and response (EDR) solutions.
To further obscure behavior, the loader rotates the final thread‑creation call among three techniques: InitOnceExecuteOnce, a TimerQueue callback, and the undocumented EtwpCreateEtwThread routine in ntdll. The signed host binary also varies across builds, suggesting a modular loader builder that can swap components while preserving the core decryption‑execution chain. This flexibility points to a dedicated development framework rather than a one‑off script.
Payloads and Associated Malware
Two of the TriBack Loader builds delivered AdaptixC2, an open‑source post‑exploitation framework that provides attackers with capabilities such as credential harvesting, lateral movement, and command execution. A third build adopted a Claude‑themed lure; it used DonutLoader to inject the Beagle backdoor—a malware first documented by Sophos—into memory. The Beagle implant communicated with license[.]claude‑pro[.].com, completing the infection chain. The fourth loader variant’s payload remained unrecovered; its associated encrypted .dat/.log file was never obtained, leaving the ultimate purpose of that chain unknown. Across variants, the attackers reused a consistent XOR key, a detail noted by Sophos when analyzing samples dating back to February 2026.
Spear‑Phishing Campaigns and Persistence Mechanisms
Social engineering played a critical role in JadeProx’s infection vectors. One phishing archive masqueraded as a fake beverage‑company account statement, enticing recipients to open a malicious attachment that deployed the loader. Another campaign impersonated Anthropic’s Claude AI platform, leveraging the newly registered domain claude‑pro[.]com (registered March 28 2026). Victims who downloaded the purported Claude installer faced a UAC prompt; upon approval, an MSI package placed the sideloading chain in the Windows Startup folder, ensuring persistence across reboots. The Claude‑themed variant also installed a counterfeit MSI that dropped DonutLoader, which subsequently executed Beagle. These tactics illustrate the operators’ ability to blend technical sophistication with convincing lures to bypass user‑centric defenses.
Vulnerability Scanning and Exploitation
Beyond credential‑based access, the JadeProx actors performed broad vulnerability scans using Nuclei with only critical‑severity templates. The scan list comprised 14,653 Hong Kong education‑related URLs, from which 13 unique vulnerabilities were identified. Although the report does not detail how many of these led to successful exploitation, the operators attempted to leverage four specific CVEs against individual hosts:
- CVE‑2018‑11511 (ASUSTOR ADM) – CVSS 9.8
- CVE‑2021‑24139 (10Web Photo Gallery WordPress plugin) – CVSS 9.8
- CVE‑2021‑31755 (Tenda AC11 routers) – CVSS 9.8
- CVE‑2021‑32305 (WebSVN) – CVSS 9.8
All four flaws carry a maximum CVSS base score of 9.8. The Tenda vulnerability (CVE‑2021‑31755) had already been listed in CISA’s Known Exploited Vulnerabilities catalog since November 3 2021, with a federal remediation deadline that expired two weeks prior to the activity. The reliance on older, high‑impact flaws underscores the attackers’ strategy of exploiting unpatched systems while reserving their custom loader for post‑compromise operations.
Detection Guidance and Indicators
Group‑IB and Sophos recommend several detection strategies focused on the loader’s distinctive file‑system artifacts. Defenders should:
- Flag signed vendor binaries executing from user‑writable, temporary, or Startup directories when an encrypted .dat or .log file resides in the same folder.
- Monitor for copies of files such as hostfxr.dll, avk.dll, or MpClient.dll, along with nested CL###### folders and ~del.vbs.bat scripts.
- Block or investigate traffic to the attacker‑controlled domains: claude‑pro[.]com, license[.]claude‑pro[.]com, sylverixstrategy[.]com, gouvvbo[.]top, vertextrust-advisors[.]com, and the trio of security‑vendor look‑alikes (update‑trellix[.]com, update‑crowdstrike[.]com, update‑sentinelone[.]com) that share a single IP address.
- Watch for connections to the staging server at 43.106.71.28:8000.
Additionally, prioritize patching internet‑facing Java applications and any public‑facing system bearing the four CVEs listed above, as these represent the most likely initial intrusion vectors employed by JadeProx.
Conclusion and Attribution Challenges
The JadeProx campaign demonstrates a sophisticated blend of opportunistic vulnerability exploitation, custom loader development, and socially engineered phishing. While the tools and techniques—particularly the reusable XOR key and the modular TriBack Loader—show continuity, Group‑IB refrains from attributing the activity to a known threat‑actor cluster. The China‑nexus ecosystem is notorious for the fluid exchange of utilities, meaning that similar tooling does not necessarily imply a common operator. Consequently, defenders should focus on behavioral indicators (DLL sideloading patterns, anomalous startup persistence, and specific network IOCs) rather than relying solely on attribution to prioritize mitigation efforts. Continued monitoring of the listed domains and proactive patching of the disclosed high‑CVSS flaws remain essential steps to curtail the threat posed by JadeProx and similar operations.