JadeProx and TriBack: an APT campaign on government and health

Group-IB has detailed a China-nexus cyber-espionage operation, tracked as JadeProx, that used a previously undocumented Windows loader called TriBack. The campaign came to light through an exposed cloud server — a common way, in this field, for APT operations to be uncovered. We stick to the researchers’ findings, without extending attribution beyond what was stated.

How the campaign was uncovered

The starting point was a server in Alibaba Cloud (Singapore region), found in mid-April 2026. It contained traces of active intrusions, including:

• an attack on a Vietnamese public hospital’s medical imaging system,
• an attack on Malaysia’s Ministry of Foreign Affairs,
• scanning and exploitation follow-up against Hong Kong education infrastructure,
• a spear-phishing package addressed to the National Congress of Honduras.

The target profile — government, healthcare and education across Asia and Latin America — points to an operation aimed at intelligence, not financial gain.

How the TriBack loader works

According to Group-IB, TriBack appears in four infection chains based on DLL sideloading. Most variants pair legitimate, signed executables with malicious DLLs and an encrypted payload. The malware reverses the payload bytes, XORs them with a rolling key, and runs the shellcode through Win32 calls that EDR watches less closely than the classic CreateThread.

The delivered payloads include AdaptixC2 (an open-source post-exploitation framework) in two variants, and in one case the Beagle backdoor, distributed under a fake “Claude AI” theme via the spoofed domain claude-pro[.]com. It is another example of abusing recognisable AI brands as a lure — a vector that will keep recurring.

Note: old, known vulnerabilities were used

The key defensive takeaway is mundane: the campaign targeted four critical vulnerabilities (CVSS 9.8) — CVE-2018-11511, CVE-2021-24139, CVE-2021-31755 and CVE-2021-32305. These are flaws from 2018–2021, long since patched. A sophisticated actor did not need zero-days; unpatched, outdated systems were enough.

This is consistent with what we have seen for years: vulnerability management and eliminating technical debt also protect against nation-state groups. That applies especially to under-funded IT sectors — such as healthcare, where old devices can stay exposed for years.

What to do

1. Patch old, known CVEs. Start with internet-facing systems and vulnerabilities in the KEV catalog. The actor used flaws from years ago, not new ones.
2. Detect DLL sideloading. Monitor signed binaries loading unusual DLLs from non-standard paths — the signature of this and many similar campaigns.
3. Block AI-brand lures. Teach users that “Claude/ChatGPT apps” from domains like claude-pro[.]com are a classic bait; download software only from official sources.
4. Protect sensitive sectors in particular. Hospitals, government and education are intelligence targets — they need segmentation and monitoring despite limited budgets.
5. Treat exposed servers as a warning. This campaign fell to its own misconfiguration; the same hygiene (closing exposure) protects you too.

The bottom line

JadeProx is a reminder that a “sophisticated” adversary does not mean “unstoppable.” The operation relied on old vulnerabilities and proven techniques, and was undone by an ordinary mistake — an exposed server. The basics — patching, sideloading detection, caution toward lures — genuinely raise the cost of such an attack. If you want to check whether you are exposing old flaws, let’s test it.

Sources: The Hacker News, Group-IB, BleepingComputer.