A recent operational security (OPSEC) lapse by cyber espionage operators has unveiled a widespread campaign targeting institutions across multiple continents. This campaign, identified as JadeProx, employs a newly discovered malware loader named TriBack to infiltrate systems in sectors such as healthcare, government, and education.
Discovery of the JadeProx Campaign
In April 2026, cybersecurity researchers uncovered an exposed staging server belonging to the attackers. This server contained a wealth of information, including command histories, phishing kits, and various tools, providing a comprehensive view of the ongoing operations. The inadvertent exposure revealed that the campaign had compromised entities like a Vietnamese public hospital’s medical imaging system, Malaysia’s Ministry of Foreign Affairs, and several educational institutions in Hong Kong. Additionally, similar activities were detected in Honduras, where attackers used deceptive themes to lure victims into executing malicious payloads.
Technical Insights into TriBack Loader
TriBack Loader initiates its attack through DLL sideloading, a technique that involves placing a malicious DLL file alongside a legitimate application. Upon execution, the loader decrypts and runs shellcode using Windows callback functions, a method designed to evade detection by security software. Variants of TriBack have been observed deploying different payloads, including AdaptixC2 beacons and a backdoor known as Beagle. The attackers also set up counterfeit portals, such as a fake Venezuelan municipal tax system, to harvest credentials from unsuspecting users.
Infrastructure and Operational Failures
The attackers’ infrastructure was hosted on Alibaba Cloud, where they left a Python web server with directory listing enabled, inadvertently exposing their tools and methodologies. The server contained various utilities like port forwarders, SOCKS tunnels, and network scanners, as well as scripts intended to conceal their activities from cloud monitoring services. Command logs from the server indicated unauthorized access to the Vietnamese hospital’s imaging system and attempted breaches of Malaysian foreign affairs systems. These logs also detailed the use of DLL sideloading packages to deploy malware on Windows hosts via internal tunnels.
TriBack Loader’s design emphasizes stealth. It arrives as a compact set of files, including a signed application, a malicious DLL, and an encrypted data file. After decryption, the loader executes code through unconventional Windows callbacks, helping it bypass endpoint security measures that monitor standard thread creation patterns. Over a two-month period, researchers observed four distinct builds of TriBack, each modifying host binaries and callback methods while maintaining core functionalities.
This incident underscores the critical importance of robust OPSEC practices among cyber operators. Even sophisticated campaigns can be compromised by seemingly minor oversights, leading to the exposure of extensive espionage activities. For organizations, this serves as a stark reminder to implement comprehensive security measures, including regular audits and monitoring, to detect and mitigate such threats effectively.
