China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks
China-nexus JadeProx deploys TriBack Loader against Asian and Latin American government, healthcare, and education
Group-IB discovered an exposed Alibaba Cloud server revealing JadeProx, a China-linked operation targeting government, healthcare, and education organizations across Asia and Latin America with a previously undocumented Windows loader called TriBack Loader. The loader uses DLL sideloading with rotating APIs (InitOnceExecuteOnce, TimerQueue, EtwpCreateEtwThread) to evade EDR detection and deliver post-exploitation frameworks including AdaptixC2 and Beagle backdoor. The operators conducted phishing campaigns impersonating Claude (Anthropic's AI software), scanned Hong Kong education infrastructure, and exploited known vulnerabilities including CVE-2021-31755 and CVE-2018-11511.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Group-IB?
Get an email when a new story names Group-IB, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe JadeProx operation succeeded partly because organizations were still exposed to vulnerabilities dating back to 2018 and 2021, demonstrating that unpatched legacy flaws remain a reliable entry point for advanced threat actors. Attackers combined this with phishing campaigns impersonating trusted AI software (Claude/Anthropic) to lower user defenses and gain initial access. Once inside, the TriBack Loader's use of DLL sideloading with rotating Windows APIs allowed it to evade modern EDR solutions, highlighting how sophisticated loaders can render endpoint controls ineffective when underlying hygiene is poor. The exposure of an Alibaba Cloud server by the attackers themselves also underscores that operational security failures can cut both ways — but defenders cannot rely on adversary mistakes to protect critical infrastructure.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — claude-pro.com
- domain — license.claude-pro.com
- cve — CVE-2018-11511
- cve — CVE-2021-24139
- cve — CVE-2021-31755
- cve — CVE-2021-32305
- malware — TriBack Loader
- malware — AdaptixC2
- malware — Beagle
- malware — DonutLoader