Full research report

China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

The JadeProx operation illustrates a recurring pattern in China-nexus intrusion sets: sophisticated custom loader engineering deployed downstream of initial access achieved through years-old, unpatched critical vulnerabilities — here, four CVSS 9.8 flaws disclosed between 2018 and 2021. TriBack Loader's rotation of Win32 callback APIs and signed host binaries across four builds reflects deliberate evasion design, while the scanning infrastructure used commodity tools (Nuclei, fscan) against a pre-compiled target list, suggesting the cluster separates its custom capability development from opportunistic reconnaissance. The fake claude-pro[.]com campaign is potentially the highest-exposure element, extending the attack surface beyond named government and healthcare entities to any end-user exposed to malvertising, though that breadth remains unconfirmed. Group-IB and Sophos each reached the same attribution ceiling — China-nexus, unattributed to a named group — from independent evidence bases, which is itself informative: the tooling overlap with Mustang Panda and Earth Lusca exists but is insufficient to confirm operator identity in an ecosystem characterised by shared infrastructure. Defenders should treat the three-file sideloading artefact as the most reliable hunt anchor, as it is consistent across all four loader variants despite surface variation in host binary and callback mechanism.

What happened

In mid-April 2026, Group-IB discovered an Alibaba Cloud staging server in Singapore with directory listing enabled, exposing the operational artefacts of a China-nexus cluster now tracked as JadeProx. The server's bash history, phishing packages, post-exploitation tools, and webshell paths documented active intrusions against a Vietnamese public hospital's medical imaging system and Malaysia's Ministry of Foreign Affairs, along with Nuclei-based scanning of Hong Kong education infrastructure and spear-phishing packages targeting the Honduras National Congress. A parallel campaign used a fake Anthropic Claude website (claude-pro[.]com) to deliver the same loader chain via a trojanised MSI installer, assessed by Sophos as likely tied to malvertising. Group-IB published the full report on 23 July 2026; Sophos had independently disclosed the Beagle component on 7 May 2026.

Affected scope

Government ministries and public-sector healthcare providers across Southeast Asia (Vietnam, Malaysia, Hong Kong) and Latin America (Honduras, Venezuela); education institutions; and potentially any end-user exposed to the fake claude-pro[.]com malvertising campaign. Internet-facing systems running ASUSTOR ADM (CVE-2018-11511), 10Web Photo Gallery for WordPress (CVE-2021-24139), Tenda AC11 routers (CVE-2021-31755), and WebSVN (CVE-2021-32305) were actively scanned and targeted for exploitation.

Technical assessment

TriBack Loader arrives as a three-file set — a legitimately signed vendor binary, a malicious DLL, and an encrypted payload — where the DLL performs byte reversal and rolling XOR decryption before invoking shellcode through Win32 callback APIs (InitOnceExecuteOnce, TimerQueue callbacks, or the undocumented ntdll routine EtwpCreateEtwThread) rather than standard thread-creation calls, reducing visibility to endpoint detection. Four build variants rotate the host binary and callback mechanism, suggesting an internal builder. Two variants deliver AdaptixC2; a third uses DonutLoader to load the Beagle backdoor, which supports file operations and command execution over encrypted C2 channels. Initial access to named targets was achieved through webshells on exposed Java management interfaces; subsequent activity used tunnelling tools (iox, suo5, Neo-reGeorg) for lateral movement and a script (fuckaliyun.sh) to suppress cloud-host security monitoring.

Recommended defensive actions

  1. Immediately patch or isolate all internet-facing systems running Tenda AC11 firmware (CVE-2021-31755, CISA KEV), ASUSTOR ADM (CVE-2018-11511), 10Web Photo Gallery WordPress plugin (CVE-2021-24139), and WebSVN (CVE-2021-32305) — all CVSS 9.8 and actively targeted by this cluster.
  2. Block the following at perimeter controls: claude-pro[.]com, license[.]claude-pro[.]com, sylverixstrategy[.]com, gouvvbo[.]top, vertextrust-advisors[.]com, update-trellix[.]com, update-crowdstrike[.]com, update-sentinelone[.]com; and IP 43.106.71[.]28.
  3. Hunt endpoint telemetry for signed vendor binaries executing from user-writable, temporary, or Startup directories alongside co-located encrypted .dat or .log files; flag unexpected copies of avk.dll, hostfxr.dll, or MpClient.dll, nested _CL_###### folder structures, and presence of ~del.vbs.bat.
  4. Audit and restrict internet exposure of Java application servers and management consoles; deploy webshell detection on all Java-based management interfaces as a priority given the confirmed hospital intrusion vector.

Uncertainties and evidence gaps

  • Attribution to a specific named APT group remains unconfirmed; Group-IB explicitly declines to link JadeProx to Mustang Panda, Earth Lusca, or Tropic Trooper, citing China-nexus tool-sharing norms.
  • The payload of TriBack Loader Variant 4 (DeviceSync) was never recovered; the full scope of that infection chain is unknown.
  • Whether claude-pro[.]com operated as broad malvertising or narrowly targeted delivery has not been independently confirmed beyond Sophos's assessment.
  • The number of Hong Kong education targets successfully compromised from the 14,653 scanned URLs is not disclosed in the published evidence.
  • Sophos noted a shared XOR key across builds from February 2026 but assessed this insufficient to confirm single-actor operation; Group-IB's cluster grouping based on the exposed server has not been independently replicated by a third research team.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessRemote, unauthenticated access to internet-exposed management interfaces and web applications; spear-phishing and potential malvertising for end-user workstation access
ComponentInternet-facing Java management consoles (webshell initial access); ASUSTOR ADM, WordPress 10Web Photo Gallery plugin, Tenda AC11 router firmware, and WebSVN web interface (scanning targets); Windows DLL search-order and Startup directory persistence (loader delivery)
MechanismExploitation of publicly known, unpatched critical vulnerabilities for initial foothold, followed by DLL sideloading of a legitimately signed vendor binary to decrypt and execute shellcode via low-visibility Win32 callback APIs
ImpactFull remote code execution and persistent access; file exfiltration and command execution via Beagle; lateral movement capability via tunnelling tools on compromised hosts
DetectionSigned vendor binaries in Startup or user-writable directories alongside encrypted .dat/.log files; unexpected avk.dll, hostfxr.dll, or MpClient.dll copies; outbound connections to listed C2 domains on TCP 443 or UDP 8080; nested _CL_###### folders; ~del.vbs.bat presence
MitigationApply vendor patches for all four named CVEs; block listed IOC domains and staging IP; restrict internet exposure of Java management interfaces; monitor Startup directories for unexpected signed binaries
Exploitation status

CVE-2021-31755 confirmed exploited in the wild (CISA KEV added 2021-11-03, EPSS 99th percentile, public PoC on GitHub); all four CVEs actively used by JadeProx in scanning and post-access exploitation against named targets per Group-IB primary evidence.

Research process

Investigation began from the source material's assertion of a China-nexus operation using a new Windows loader against government and healthcare targets, with four named CVEs and a Group-IB report as the primary evidence anchor. Fetching the Group-IB and Sophos primary reports confirmed two independent research teams had documented overlapping infrastructure and malware families from separate starting points, with Sophos predating Group-IB by over two months. NVD confirmed CVE-2021-31755's CISA KEV status and referenced public exploit code, validating the priority-patching recommendation. Four further independent outlets corroborated core campaign details across separate domains, raising overall confidence to high.

  1. Do primary sources for JadeProx and TriBack Loader exist beyond the THN article?
    Searched for 'JadeProx TriBack Loader Group-IB 2026' and reviewed search results

    Identified Group-IB blog, Sophos blog, BleepingComputer, CybersecurityNews, Infosecurity Magazine, and Cyberpress as independent sources covering the campaign

    why Multiple independent domains in results indicated genuine broad coverage rather than a single-source story, warranting primary source verification

  2. What does the Group-IB primary report contain, and does it support the source material's claims?
    Fetched the Group-IB blog post on JadeProx
    group-ib.com ↗

    Confirmed: four TriBack Loader variants, named targets (Vietnamese hospital, Malaysia MFA, Hong Kong education, Honduras Congress, Venezuela municipality), full IOC list including staging IP and C2 domains, all four CVEs at CVSS 9.8, post-exploitation toolkit (iox, suo5, fscan, fuckaliyun.sh), and explicit attribution caveat declining to name a specific APT

    why Establishes the factual core of the report; server-based forensic evidence is the strongest available attribution anchor and resolves most of the source material's claims as confirmed facts

  3. Does the Sophos Beagle report independently corroborate Group-IB, and what does it add?
    Fetched the Sophos X-Ops blog post on the fake Claude campaign and Beagle backdoor
    sophos.com ↗

    Sophos independently documented the DonutLoader/Beagle chain from a different starting point (the fake Claude site), confirmed infrastructure overlapping with Group-IB IOCs, published 7 May 2026 — predating Group-IB's report — and noted a shared XOR key in builds back to February 2026 while declining to attribute to a single actor

    why Second independent research team beginning from a different artefact and reaching overlapping conclusions strengthens confidence; Sophos's earlier disclosure and attribution caution are both material facts for the uncertainty section

  4. Is CVE-2021-31755 confirmed on the CISA KEV and is public exploit code available?
    Fetched the NVD detail page for CVE-2021-31755
    nvd.nist.gov ↗

    CVSS 9.8 Critical; stack buffer overflow in Tenda AC11 via crafted POST request to /goform/setmac; CISA KEV entry dated 2021-11-03 with federal deadline 2021-11-17 (expired); public exploit code referenced on GitHub (Yu3H0/IoT_CVE)

    why Authoritative confirmation of exploitation status and PoC availability directly from NVD; the expired federal remediation deadline underscores that vulnerable devices are likely still present in the wild

  5. Does BleepingComputer independently confirm the fake Claude campaign details?
    Fetched BleepingComputer article on the Beagle backdoor and fake Claude AI website
    bleepingcomputer.com ↗

    Independently confirms G Data signed binary (NOVupdate.exe) sideloading, avk.dll as the malicious DLL, Beagle C2 at license[.]claude-pro[.]com over TCP 443 and UDP 8080, AES encryption, and notes campaign first spotted by Malwarebytes in April 2026

    why Third independent domain corroborating campaign infrastructure; Malwarebytes reference adds a fourth research team with overlapping observations, further supporting confidence

  6. Do additional independent outlets corroborate the operation without simply republishing Group-IB?
    Fetched CybersecurityNews and Infosecurity Magazine articles
    cybersecuritynews.com ↗

    CybersecurityNews independently describes the OPSEC failure, exposed-server discovery, and TriBack technical detail; Infosecurity Magazine confirms fake Claude site, Beagle capabilities, Sophos attribution caveats, and references a February 2026 Lab52 report noting PlugX-lineage similarities that Sophos assessed as tentative

    why Lab52 reference establishes that independent researchers flagged this infrastructure before both Sophos and Group-IB published, and the PlugX-lineage observation — while not confirmed — is a material data point for ongoing attribution work

Named in this story
ActorsJadeProx (China-nexus cluster, Group-IB designation; no confirmed link to named APT)Tooling overlaps noted with Mustang Panda, Earth Lusca, Tropic Trooper — not confirmed
MalwareTriBack LoaderBeagle backdoorAdaptixC2DonutLoader
TargetsVietnam – public hospital medical imaging (PACS) systemMalaysia – Ministry of Foreign AffairsHong Kong – educational institutions (14,653 URLs scanned)Honduras – National CongressVenezuela – Municipality of Piar
Related CVEs CVE-2018-11511CVE-2021-24139CVE-2021-31755CVE-2021-32305

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (3 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 56 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
CISA KEVkev ok1653 records Primary evidence1 matched items Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue.
NVDcve ok900 records Primary evidence1 matched items Supplied a vendor or government advisory opened and verified during focused research.
The Hacker Newsnews ok10 records Primary evidence1 matched items Published the source report used to frame and date the event.
BleepingComputernews ok12 records Corroborating1 matched items Supplied independent analysis opened and verified during focused research.
FIRST EPSSepss ok Context1 matched items Added exploitation-probability context; EPSS does not itself prove exploitation.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Cisco PSIRTvendor_advisory ok5307 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok260 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok662 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1005 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok15 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok11 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok17 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok9 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1583 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 5 opened outside the registered collection
References & evidence
Vulnerability & exploitation2
CVE-2021-31755 CISA KEV Tenda AC11 Router · added 2021-11-03 CISA catalog ↗
CVE-2021-31755 EPSS 85.8% 100th percentile exploitation probability
PoC & exploit code1
Donuts and Beagles: Fake Claude site spreads backdoor – Sophos X-Ops sophos.com ↗

Technical write-up documenting Beagle backdoor internals, DonutLoader chain, DLL sideloading artefacts, and C2 protocol detail

Vendor & gov advisories2
Group-IB: JadeProx – China-Nexus Operation Using TriBack Loader group-ib.com ↗

Primary vendor report with full IOC list, four loader variants, named targets, all four CVEs, post-exploitation toolkit, and attribution caveats

NVD – CVE-2021-31755 Detail nvd.nist.gov ↗

CVSS 9.8 Tenda AC11 stack overflow; CISA KEV entry confirmed with expired federal remediation deadline of 2021-11-17

Analysis & research4
Fake Claude AI website delivers new 'Beagle' Windows malware – BleepingComputer bleepingcomputer.com ↗

Independent corroboration of G Data sideloading chain, avk.dll, Beagle C2 infrastructure, and Sophos detection signatures

Hackers' OPSEC Mistake Exposed a Global Espionage Campaign and Its New TriBack Malware – CybersecurityNews cybersecuritynews.com ↗

Additional independent coverage corroborating exposed-server discovery mechanism and TriBack technical detail

Fake Claude AI Site Drops Beagle Backdoor on Windows Users – Infosecurity Magazine infosecurity-magazine.com ↗

Independent corroboration of campaign; references February 2026 Lab52 analysis suggesting PlugX-lineage connection, which Sophos assessed as tentative

China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks – The Hacker News thehackernews.com ↗

Synthesises Group-IB and Sophos findings; confirms all four CVEs validated against NVD on publication date