An exposed **Alibaba Cloud** server in Singapore, discovered by **Group-IB** in mid-April 2026, has shed light on the operations of **JadeProx**. Although the server was offline by the time **Group-IB**'s report was published on July 23, 2026, its contents provided a detailed view of the threat actor's tactics, techniques, and procedures. The server's bash history, phishing packages, post-exploitation tools, and webshell paths revealed active intrusions against a Vietnamese public hospital's medical imaging system and Malaysia's Ministry of Foreign Affairs. It also showed scanning and exploitation attempts against Hong Kong education infrastructure, alongside a spear-phishing package aimed at the National Congress of Honduras. The attackers gained access to the hospital's imaging server through webshells deployed on an exposed Java management interface. ## One Loader, Four Builds **TriBack Loader** is characterized by four distinct infection chains, all built around DLL sideloading. Most recovered builds combine a legitimate, signed executable with a malicious DLL and an encrypted `.dat` or `.log` payload. The malicious DLL reverses the payload bytes, XORs them with a rolling key, and executes the shellcode using **Win32** calls. These calls are designed to bypass detection by **EDR** solutions, employing less-monitored functions such as `InitOnceExecuteOnce`, `TimerQueue` callbacks, and `EtwpCreateEtwThread` – an undocumented thread-creation routine in **ntdll**. This consistent API sequence across variants suggests the use of a custom loader builder. The signed host binaries also varied between these variants. Two variants were observed delivering **AdaptixC2**, an open-source post-exploitation framework. A **Claude**-themed variant utilized **DonutLoader** to deploy **Beagle**, a backdoor first documented by **Sophos**. The payload for the fourth variant remains unknown, as its encrypted companion file was never recovered. One spear-phishing archive contained a fake beverage-company account statement as a decoy. Another campaign impersonated **Anthropic**'s **Claude** software, operating from `claude-pro[.]com` (registered March 28, 2026). This campaign served a malicious MSI installer that, after a **UAC** prompt, established persistence by placing the sideloading chain in the Windows Startup folder. The **Beagle** backdoor delivered through this method reported to `license[.]claude-pro[.]com`. **Sophos**, analyzing the fake **Claude** site, its hosting infrastructure, and malware samples, identified a shared XOR key in builds dating back to February. However, **Sophos** noted that a shared key alone was insufficient to definitively attribute the activity to a single actor.  **Group-IB**, leveraging the exposed server's contents, linked these builds to the Asian intrusions. They stopped short of naming an established group, citing the fluid nature of tooling within the China-nexus ecosystem, where matching tools does not always equate to matching operators. The operators also employed **Nuclei** with critical-severity templates, targeting a list of 14,653 Hong Kong education-related URLs. This activity surfaced 13 unique vulnerabilities. While 14,653 URLs were scanned, the report does not specify how many of the subsequent exploitation attempts were successful. The report identified four **CVEs** that **JadeProx** attempted to exploit against individual hosts, all confirmed by The Hacker News against **NVD** on July 23, 2026: **CVE-2018-11511** in **ASUSTOR ADM**, **CVE-2021-24139** in the **10Web Photo Gallery WordPress** plugin, **CVE-2021-31755** in **Tenda AC11** routers, and **CVE-2021-32305** in **WebSVN**. Each of these vulnerabilities carries a **CVSS** base score of 9.8. Notably, the **Tenda** bug has been listed in **CISA**'s **Known Exploited Vulnerabilities catalog** since November 3, 2021, with a federal remediation deadline that passed two weeks later. ## Detection Starts With the Sideloading Chain **Sophos** suggested that the fake **Claude** site was likely part of an active malvertising campaign, implying a broader exposure risk extending beyond government ministries and hospitals to general users searching for **Claude** downloads. Effective detection relies on recognizing the file layout, as filenames and signed host binaries can vary between builds. Key indicators include: * Flagging signed vendor binaries running from user-writable, temporary, or Startup directories, especially when accompanied by an encrypted `.dat` or `.log` file in the same folder. * Monitoring for unexpected copies of `hostfxr.dll`, `avk.dll`, or `MpClient.dll`, as well as nested `_CL_######` folders and `~del.vbs.bat`. * Blocking or investigating the cluster's domains: `claude-pro[.]com`, `license[.]claude-pro[.]com`, `sylverixstrategy[.]com`, `gouvvbo[.]top`, `vertextrust-advisors[.]com`, and three security-vendor lookalikes sharing one IP: `update-trellix[.]com`, `update-crowdstrike[.]com`, and `update-sentinelone[.]com`. The staging server was identified as `43.106.71[.]28` on port `8000`. These lists are derived from **Group-IB**'s July 23 report. * Prioritizing the security of internet-facing Java applications and any public-facing systems with unpatched critical (9.8-rated) flaws, including the four **CVEs** mentioned. Despite the sophisticated custom loader engineering, the initial reconnaissance and exploitation phase of this operation relied on vulnerabilities disclosed in 2018 and 2021, highlighting that even advanced threat actors often leverage readily available and unpatched flaws for initial access.