# JadeProx: China-Nexus Campaign Deploys TriBack Loader Against Government, Healthcare, and Education Targets in APAC and Latin America

> Group-IB discovered an exposed Alibaba Cloud staging server (43.106.71[.]28) revealing an active China-nexus operation, tracked as JadeProx, that compromised government, healthcare, and education organizations across Vietnam, Malaysia, Hong Kong, Honduras, and Venezuela using a custom shellcode loader (TriBack Loader) and post-exploitation tooling including AdaptixC2 and Beagle.

- **Published:** 2026-07-23T00:00:00Z
- **Last reviewed:** 2026-07-23T21:21:34.445Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1653
- **ID:** TL-2026-1653
- **Severity:** HIGH (CVSS 9.8)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** JadeProx (China)
- **Detections:** 9 · **IOCs:** 62 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2018-11511, CVE-2021-24139, CVE-2021-31755, CVE-2021-32305

## Description

JadeProx is a China-nexus threat cluster identified by Group-IB after an exposed Alibaba Cloud OSS staging server (43.106.71[.]28:8000, hosted in Singapore) was found with open Python directory listing, revealing the operator's complete toolkit, bash history, and victim access paths. The operation ran simultaneous intrusions against government, healthcare, and education entities in Vietnam (hospital PACS/JMX systems), Malaysia (Ministry of Foreign Affairs), Hong Kong (14+ education institutions, 14,653 nuclei scan targets), Honduras (government networks via a beverage-company-themed phishing lure), and Venezuela (a municipal tax portal). The intrusion set is unified by the TriBack Loader malware framework: a three-file triad (signed EXE + malicious DLL + encrypted DAT/LOG) that uses DLL sideloading against legitimate signed binaries (ServiceHub.DataWarehouseHost.exe, Microsoft Service Hub AnyCPU, avk.exe from G DATA, MpCopyAccelerator.exe), decrypts its payload with a two-stage byte-reversal-plus-rolling-XOR routine, and executes shellcode through Win32 callback APIs (InitOnceExecuteOnce, TimerQueue, EtwpCreateEtwThread) to evade EDR hooking. Four variants were identified, delivering AdaptixC2 (variants 1-2) or Beagle via DonutLoader shellcode injection (variant 3). Initial access combines exploitation of internet-facing applications (four CVSS-9.8 CVEs: ASUSTOR ADM SQLi, 10Web Photo Gallery SQLi, Tenda AC11 buffer overflow, WebSVN command injection) with spearphishing archives containing LNK/VBS droppers and MSI installers themed as 'Estado de Cuenta' account statements (Honduras) and fake Claude-Pro AI software distribution (Anthropic brand impersonation) and GolddTV. Post-exploitation used a Chinese-origin toolkit staged on the exposed server: iox and NPS (port forwarding/proxy tunneling), suo5 (SOCKS5-over-HTTP tunneling), Neo-reGeorg (HTTP tunnel webshell maintenance), nuclei (mass CVE scanning — 14,653 Hong Kong targets alone), fscan (internal network reconnaissance), and XMRig Proxy (cryptomining relay). A Chinese-language fuckaliyun.sh script was used to disable Alibaba Cloud's built-in security agent on compromised OSS infrastructure. Attribution is to a China-nexus ecosystem rather than a single named group; Group-IB tracks it separately as JadeProx to avoid misattribution, citing TTP and tooling overlap with Mustang Panda, Tropic Trooper, Earth Lusca, and APT27, plus a GitHub Pages analytics-cookie beaconing technique previously associated with Tropic Trooper. C2 infrastructure used Cloudflare fronting (sylverixstrategy[.]com), DigitalOcean hosting (gouvvbo[.]top, vertextrust-advisors[.]com), and Alibaba Cloud US (license.claude-pro[.]com), registered via NameSilo. Credential-harvesting phishing portals impersonated a Venezuelan municipal tax authority (Municipality Piar) and a fake financial services firm (Vertex Trust Advisors). Persistence is achieved by dropping the EXE-DLL-DAT triad into the Windows Startup folder, with self-deleting batch/VBS scripts (del.vbs.bat) used to clean forensic traces after execution.

## MITRE ATT&CK

- T1595.002 Active Scanning: Vulnerability Scanning
- T1583.001 Acquire Infrastructure: Domains
- T1583.006 Acquire Infrastructure: Web Services
- T1588.002 Obtain Capabilities: Tool
- T1190 Exploit Public-Facing Application
- T1566.001 Phishing: Spearphishing Attachment
- T1204.002 User Execution: Malicious File
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1574.001 DLL
- T1036.005 Match Legitimate Resource Name or Location
- T1140 Deobfuscate/Decode Files or Information
- T1218 System Binary Proxy Execution
- T1027.013 Obfuscated Files or Information: Encrypted/Encoded File
- T1070.004 Indicator Removal: File Deletion
- T1046 Network Service Discovery
- T1071.001 Application Layer Protocol: Web Protocols
- T1090.001 Proxy: Internal Proxy
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1572 Protocol Tunneling
- T1105 Ingress Tool Transfer
- T1496 Resource Hijacking
- T1587 Develop Capabilities
- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1055 Process Injection
- T1539 Steal Web Session Cookie
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1090 Proxy
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel

## Sources

- [JadeProx: China-nexus TriBack Loader campaign](https://www.group-ib.com/blog/jadeprox-china-nexus-triback-loader/)
- [NVD - CVE-2018-11511](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2018-11511)
- [NVD - CVE-2021-24139](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2021-24139)
- [NVD - CVE-2021-31755](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2021-31755)
- [NVD - CVE-2021-32305](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2021-32305)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1653