A recent investigation has uncovered a cyber espionage campaign attributed to a China-linked group, identified as JadeProx. This operation has been targeting government, healthcare, and educational institutions across Asia and Latin America, utilizing a newly discovered Windows loader named TriBack Loader.
The campaign came to light when researchers discovered an exposed Alibaba Cloud server in Singapore in mid-April 2026. Although the server was offline by the time the findings were published on July 23, 2026, its contents provided significant insights into the group’s activities. The server’s bash history, along with various phishing packages, post-exploitation tools, and webshell paths, revealed active intrusions into a Vietnamese public hospital’s medical imaging system and Malaysia’s Ministry of Foreign Affairs. Additionally, there were indications of scanning and exploitation attempts targeting Hong Kong’s educational infrastructure and spear-phishing campaigns directed at the National Congress of Honduras.
TriBack Loader: A Versatile Tool
TriBack Loader has been identified in four distinct infection chains, all employing DLL sideloading techniques. Typically, these chains involve a legitimate signed executable paired with a malicious DLL and an encrypted payload file, often with a .dat or .log extension. The malicious DLL is designed to reverse the payload bytes, apply an XOR operation with a rolling key, and execute the shellcode using Windows API calls that are less likely to be monitored by Endpoint Detection and Response (EDR) systems.
Notably, the loader utilizes various API calls for execution, including InitOnceExecuteOnce, TimerQueue callbacks, and the undocumented EtwpCreateEtwThread function from ntdll. The use of different signed host binaries across variants suggests the presence of a custom loader builder employed by the attackers.
Two of the identified variants delivered AdaptixC2, an open-source post-exploitation framework. Another variant, themed around the AI assistant Claude, used DonutLoader to deploy Beagle, a backdoor previously documented by security researchers. The payload for the fourth variant remains unknown, as its encrypted companion file was not recovered.
Spear-Phishing Tactics
The attackers employed sophisticated spear-phishing techniques to distribute their malware. One campaign involved an archive containing a fake account statement from a beverage company as a decoy. Another campaign impersonated Anthropic’s Claude software, using a domain registered on March 28, 2026, to serve a malicious MSI installer. This installer, upon execution and after prompting for User Account Control (UAC) permissions, placed the sideloading chain in the Windows Startup folder to ensure persistence. The Beagle backdoor deployed in this manner communicated with a command-and-control server hosted on the same domain.
Further analysis revealed that the attackers conducted scans using Nuclei with critical-severity templates against a list of over 14,000 Hong Kong education-related URLs, identifying 13 unique vulnerabilities. Specific exploits attempted by the group targeted known vulnerabilities in ASUSTOR ADM, the 10Web Photo Gallery WordPress plugin, Tenda AC11 routers, and WebSVN, all carrying high CVSS base scores.
While the tools and techniques observed in this campaign are consistent with those used by various China-linked threat actors, the researchers have not attributed the activity to a specific known group. This caution is due to the common practice of tool-sharing among such actors, making precise attribution challenging.
The emergence of TriBack Loader and the associated JadeProx campaign underscores the evolving tactics of cyber espionage groups. Organizations, particularly those in government, healthcare, and education sectors, must remain vigilant and implement robust security measures to defend against such sophisticated threats.
