JadeProx's TriBack Loader Evades EDR Via Signed Binaries

The espionage campaign that breached a Vietnamese hospital, a foreign ministry, and a national legislature came apart because someone forgot to turn off directory listing on a web server. In mid April 2026, threat intelligence firm Group-IB found an exposed Alibaba Cloud staging server in Singapore with port 8000 wide open, listing the operators' bash history, webshell paths, phishing kits, and post exploitation tooling in plain view. What analysts rebuilt from that blunder is a China nexus operation they now call JadeProx, powered by a stealthy new loader named TriBack.

Key Takeaways

• Group-IB attributed the JadeProx campaign after an exposed Alibaba Cloud server (43.106.71[.]28 on port 8000) in Singapore leaked the operators' entire toolkit in mid April 2026.
• TriBack Loader abuses DLL sideloading, pairing a legitimately signed executable with a malicious DLL and an encrypted payload to run shellcode entirely in memory.
• The loader dodges endpoint detection by executing through rarely watched Win32 callbacks such as InitOnceExecuteOnce, TimerQueue, and the undocumented EtwpCreateEtwThread instead of CreateThread.
• Confirmed victims include a Vietnamese public hospital, Malaysia's Ministry of Foreign Affairs, Hong Kong education infrastructure, and the National Congress of Honduras.
• One infection chain impersonated Anthropic's Claude software through the domain claude-pro[.]com, registered March 28, 2026, to deliver a Beagle backdoor.

Who Is JadeProx?

JadeProx is the label Group-IB assigned to a China nexus espionage cluster it pieced together after the group's own operational security failed. As The Hacker News reported, the same TriBack loader turned up in every infection chain the firm reviewed, which is what let researchers connect otherwise separate intrusions into one coordinated operation. The activity lines up with patterns typically seen in China nexus intelligence collection: long dwell times, sector specific targeting, and post exploitation frameworks tuned for quiet persistence rather than smash and grab theft.

The numbers tell you this was a program, not a prank. Group-IB documented four distinct infection chains, four exploited CVEs all carrying CVSS base scores of 9.8, and automated scanning that swept 14,653 Hong Kong education related URLs to fingerprint 13 unique vulnerabilities. JadeProx is also not the only China nexus operation drawing scrutiny this month, following recent reporting on the JadePuffer autonomous ransomware cluster.

What Is the TriBack Loader?

TriBack is a previously undocumented Windows loader built as a three file triad: a signed host program, a malicious loader DLL, and an encrypted payload stored in a .dat or .log file. That structure is the whole idea. When the trusted, signed program launches, Windows loads the attacker's DLL alongside it, and the DLL quietly decrypts and runs the shellcode hidden in the data file. This technique, DLL sideloading, is catalogued by MITRE ATT&CK as T1574.002 and has been a China nexus staple for years precisely because it lets malicious code inherit the reputation of a legitimate binary.

The final payloads varied by chain. Two variants delivered AdaptixC2, an open source post exploitation framework increasingly adopted by espionage crews as a cheaper alternative to Cobalt Strike. A separate Claude themed variant used DonutLoader to run Beagle, a backdoor that reported to license[.]claude-pro[.]com. Using open source and off the shelf tooling this way also muddies attribution, since the same frameworks show up in unrelated criminal and state campaigns.

How Does TriBack Slip Past EDR?

TriBack avoids the API calls that endpoint tools watch most closely and runs its payload through rarely monitored Windows callbacks instead. Most endpoint detection and response products flag suspicious use of CreateThread, the standard way a program spins up new execution. TriBack sidesteps that telemetry entirely by registering its shellcode as a callback and letting Windows invoke it, rotating between InitOnceExecuteOnce, TimerQueue timer routines, and the undocumented ntdll function EtwpCreateEtwThread across different builds.

Before any of that runs, the loader reconstructs its payload in memory using a two step routine: it reverses the byte order, then applies a rolling XOR with a hard coded key, so nothing recognizable ever touches disk. According to GBHackers' technical breakdown, the signed host binaries were drawn from vendors including Microsoft and G DATA, meaning application allowlists that trust signed software would wave the whole chain through. None of these tricks are individually novel. The notable part is the deliberate rotation across variants, which frustrates signature based detection and forces defenders back to behavioral hunting.

Who Did JadeProx Target?

The victim list reads like an intelligence collection wish list rather than a payday. Per Cyberpress, JadeProx ran simultaneous campaigns across Southeast Asia and Latin America, hitting government, healthcare, and education organizations. Named victims include the medical imaging system of a Vietnamese public hospital, Malaysia's Ministry of Foreign Affairs, multiple Hong Kong education sites, the National Congress of Honduras, and a Venezuelan municipal tax system.

Initial access was opportunistic and varied. Operators planted webshells on an exposed Java management interface to reach the hospital, chained old but critical CVEs against edge devices, and ran targeted spear phishing where a technical exploit was not available. The mix of methods across such different sectors and continents points to a well resourced team running parallel operations, not a single opportunistic intrusion.

The Email Angle: Where Your Inbox Fits In

For all the technical craft in TriBack, one of JadeProx's entry points was an old fashioned email lure. The group registered claude-pro[.]com on March 28, 2026, and used it to impersonate Anthropic's Claude software, betting that a familiar, trusted AI brand would get a target to open an attachment or click a link. That is the same brand impersonation playbook behind the surge of AI themed scams, and it is a reminder that even nation state operators still lean on the inbox as a first door.

Attackers weaponizing trusted software names is a recurring theme in recent reporting, from fake job interview lures that harvest Google logins to attackers turning Gemini CLI into a hacking agent. The practical lesson for any inbox: a message referencing popular software is not automatically safe, and a lookalike domain like claude-pro[.]com is exactly the kind of detail worth checking before you click, whether you run a SOC or just your own Gmail.

How Should Security Teams Detect and Respond?

Because TriBack hides behind signed binaries and unusual callbacks, the detection strategy has to be behavioral rather than signature based. Group-IB and independent analysts recommend a few concrete moves for defenders:

• Hunt for signed executables loading atypical sidecar DLLs from unusual paths, the classic fingerprint of DLL sideloading described in MITRE ATT&CK T1574.002.
• Prioritize telemetry for uncommon execution callbacks, specifically InitOnceExecuteOnce, TimerQueue timers, and EtwpCreateEtwThread, particularly when paired with in memory decryption or reflective PE loading.
• Block and alert on the published indicators, including claude-pro[.]com, license[.]claude-pro[.]com, and the fake security vendor update domains update-crowdstrike[.]com, update-sentinelone[.]com, and update-trellix[.]com.
• Add passive DNS and newly registered domain monitoring so lookalike infrastructure gets caught before it is widely reported.
• Patch internet facing edge devices and management interfaces quickly, since JadeProx leaned on years old CVEs and exposed Java consoles to get its initial foothold.

The uncomfortable takeaway is that JadeProx did not need a zero day or exotic malware to breach ministries and hospitals. It needed patient tradecraft, cheap open source tooling, and the fact that most environments still trust anything with a valid signature. The only reason we know the full scope is that the attackers made a mistake defenders usually cannot count on, according to Cybersecurity News.

Sources: The Hacker News, Cyberpress, GBHackers, Cybersecurity News, and MITRE ATT&CK.