Actor Profile

JadeProx is a China-nexus threat actor tracked by Group-IB, discovered through an exposed Alibaba Cloud server in Singapore in mid-April 2026. The actor targets government, healthcare, and education organizations across Asia and Latin America. Group-IB stops short of linking JadeProx to an established APT group, noting that tooling moves freely within the China-nexus ecosystem and tool overlap does not confirm operator identity. The actor demonstrates capability in both targeted intrusion operations and opportunistic vulnerability scanning at scale.

TTPs (Tactics, Techniques, Procedures)

JadeProx employs DLL sideloading (T1574.002) with four distinct TriBack Loader variants that pair legitimate signed executables with malicious DLLs and encrypted payloads (.dat/.log files). The loader reverses payload bytes, applies XOR decryption with a rolling key, and executes shellcode via low-visibility Win32 APIs including InitOnceExecuteOnce, TimerQueue callbacks, and the undocumented EtwpCreateEtwThread routine (T1055). Initial access includes spear-phishing with malicious archives (T1566.001), malvertising campaigns impersonating Anthropic's Claude software, and webshell deployment on exposed Java management interfaces (T1190, T1505.003). Post-exploitation frameworks include AdaptixC2 and Beagle backdoor. The actor conducts mass vulnerability scanning using Nuclei against 14,653 Hong Kong education URLs, targeting CVE-2018-11511, CVE-2021-24139, CVE-2021-31755 (CISA KEV), and CVE-2021-32305—all rated CVSS 9.8. Persistence achieved via Windows Startup folder placement (T1547.001).

Targets & Patterns

JadeProx targets government, healthcare, and education sectors across Asia (Vietnam, Malaysia, Hong Kong, Singapore, China) and Latin America (Honduras). Confirmed intrusions include a Vietnamese public hospital's medical imaging system accessed via webshells on an exposed Java interface, Malaysia's Ministry of Foreign Affairs, and scanning/exploitation attempts against Hong Kong education infrastructure. A spear-phishing package targeted the National Congress of Honduras. The dual approach—targeted intrusions against high-value government and healthcare entities combined with mass scanning of 14,653 education-sector URLs—suggests both strategic intelligence collection and opportunistic compromise. The malvertising campaign impersonating Claude AI software indicates potential for broader victim reach beyond institutional targets to individual users searching for legitimate software downloads.

Historical Context

The TriBack Loader operation was discovered through an exposed Alibaba Cloud server found in mid-April 2026 in Singapore's region; the server went offline before Group-IB's July 23, 2026 publication. Sophos independently identified the fake Claude infrastructure and found builds with reused XOR keys dating back to February 2026, though Sophos cautioned that shared cryptographic keys alone are insufficient for attribution. The Beagle backdoor delivered by one TriBack variant was first documented by Sophos. The operation exploits vulnerabilities disclosed between 2018 and 2021, including CVE-2021-31755, which CISA added to its KEV catalog on November 3, 2021, with a federal remediation deadline that expired two weeks later. The repeated API sequence across TriBack variants suggests use of a custom loader builder framework.

Defensive Recommendations

  • Monitor for signed vendor binaries (hostfxr.dll, avk.dll, MpClient.dll) executing from user-writable directories, temporary folders, or Windows Startup paths, especially when accompanied by encrypted .dat or .log files in the same directory (T1574.002 detection)
  • Block or investigate domains: claude-pro[.]com, license[.]claude-pro[.]com, sylverixstrategy[.]com, gouvvbo[.]top, vertextrust-advisors[.]com, update-trellix[.]com, update-crowdstrike[.]com, update-sentinelone[.]com, and staging server 43.106.71[.]28:8000
  • Prioritize patching internet-facing Java applications and systems with CVSS 9.8+ vulnerabilities, specifically CVE-2018-11511, CVE-2021-24139, CVE-2021-31755, and CVE-2021-32305
  • Hunt for webshells on public-facing Java management interfaces and monitor for suspicious nested _CL_###### folders and ~del.vbs.bat files indicative of TriBack Loader deployment
  • Detect low-visibility thread creation via InitOnceExecuteOnce, TimerQueue callbacks, and EtwpCreateEtwThread API calls paired with XOR decryption routines in memory (T1055)

---

# Geopolitical Context

Geopolitical Context

The JadeProx operation reflects persistent China-nexus cyber activity targeting government and critical infrastructure across regions of strategic interest to Beijing. The intrusions into Malaysia's Ministry of Foreign Affairs and Vietnamese healthcare infrastructure are consistent with intelligence-collection priorities observed in Southeast Asia, where Beijing seeks to monitor diplomatic posture and expand influence. The spear-phishing package directed at Honduras's National Congress suggests interest in Latin American legislative processes, potentially tied to Taiwan recognition debates or Belt and Road engagement. The use of an Alibaba Cloud server in Singapore for command infrastructure underscores the operational convenience of regional cloud providers, though it does not imply state sponsorship. The tooling—custom loaders, open-source post-exploitation frameworks, and exploitation of years-old vulnerabilities—fits the profile of a resourced but not necessarily state-directed actor within the broader China-nexus ecosystem, where tooling and infrastructure are frequently shared across groups with overlapping but distinct mandates.

State Actor Alignment

Group-IB attributes the activity to a China-nexus cluster it tracks as JadeProx but explicitly declines to link the operation to an established named group, citing the fluid nature of tooling within the China-nexus ecosystem. Sophos, working independently from malware samples and infrastructure, identified overlapping indicators but similarly refrained from definitive attribution based on shared cryptographic keys alone. No government has publicly attributed JadeProx activity to a specific Chinese state entity. The targeting of foreign ministries, legislative bodies, and public health infrastructure is consistent with intelligence-collection operations, but the reliance on commodity post-exploitation frameworks and years-old CVEs may indicate a contractor, provincial actor, or lower-tier unit rather than a premier signals-intelligence service. The operation does not appear to be subject to existing sanctions regimes, and no state has announced countermeasures as of the report date.

Business Impacty pro region

The intrusions carry distinct regional consequences. In Southeast Asia, the compromise of Malaysia's Ministry of Foreign Affairs and a Vietnamese hospital's medical imaging system underscores persistent cyber-espionage risk to ASEAN member states, particularly those navigating complex relations with Beijing. The scanning of 14,653 Hong Kong education-sector URLs—yielding 13 exploitable vulnerabilities—may reflect interest in monitoring or influencing academic discourse in a jurisdiction where educational institutions remain contested political terrain. In Latin America, the Honduras National Congress lure aligns with Beijing's efforts to shape legislative and diplomatic outcomes, especially in countries that maintain or recently severed ties with Taiwan. For Europe, the operation illustrates the global reach of China-nexus actors and the risk that third-country compromises yield intelligence on European diplomatic or commercial activity conducted through Asian partners. The malvertising campaign impersonating Anthropic's Claude platform, if confirmed, extends the threat surface beyond state targets to technology users worldwide, including in allied capitals.

Forecast

If JadeProx or similarly resourced China-nexus actors continue to exploit unpatched critical vulnerabilities in internet-facing systems, government and healthcare organizations in Asia and Latin America are likely to face sustained intrusion risk, particularly where patch cycles lag disclosure by years. If the Claude impersonation campaign represents a shift toward malvertising, the actor's reach may expand beyond traditional espionage targets to include technology early-adopters and enterprise users, complicating attribution and increasing collateral exposure. If Western and allied governments elevate diplomatic or sanctions pressure on Beijing over cyber-espionage in Southeast Asia, China-nexus actors may diversify infrastructure away from traceable cloud providers or further compartmentalize operations to hinder clustering. If ASEAN states strengthen information-sharing on intrusions targeting foreign ministries and critical infrastructure, collective attribution and coordinated response may become more feasible, though political sensitivities around Beijing will likely constrain public disclosure. If the tooling observed—particularly TriBack Loader and its builder—appears in future intrusions, it may enable more confident clustering of activity, but shared-tool ecosystems will continue to complicate actor-level attribution absent additional operational security lapses.