Misconfigured Server Exposes JadeProx Espionage Campaign and New TriBack Malware
A simple operational security mistake by cyber spies led to the exposure of the JadeProx espionage campaign and its novel TriBack malware, impacting organizations across Asia and Latin America.
A critical operational security lapse has inadvertently revealed a sophisticated global espionage campaign, dubbed JadeProx, and its associated new malware, TriBack Loader. The campaign, which targeted hospitals, government entities, and educational institutions across Asia and Latin America in early 2026, was exposed when attackers left a staging server misconfigured, leaving tools, command history, and phishing packages readily accessible. This oversight provided researchers with an unprecedented look into the campaign's infrastructure and methods.
Group-IB analysts, who identified the malware and campaign, reported that TriBack Loader employs a stealthy DLL sideloading technique. To evade detection by security software, it decrypts and executes its shellcode using less common Windows callback functions, rather than typical thread creation patterns. This approach allows the malware to operate with a reduced likelihood of triggering endpoint detection and response systems. The campaign's victims included a Vietnamese public hospital's medical imaging system, the Malaysian Ministry of Foreign Affairs, and several educational institutions in Hong Kong, indicating a broad and strategic targeting approach.
Further analysis revealed that the attackers utilized fake portals, including one mimicking a Venezuelan municipal tax system, to harvest credentials from unsuspecting users. The campaign's infrastructure, hosted on Alibaba Cloud, was exposed due to a misconfigured Python web server that allowed directory listing. This exposed server contained sensitive materials such as bash history logs, webshell paths, phishing kits, and post-exploitation tools, offering a clear view of the attackers' operational workflow and tools.
Command logs found on the exposed server detailed tunneling activities into the compromised Vietnamese hospital system and attempted intrusions into Malaysian foreign affairs systems. The attackers also served DLL sideloading packages to Windows hosts accessed through internal network tunnels. In parallel, a separate operation targeting Honduras used a signed Microsoft host binary to load a malicious DLL, a tactic designed to bypass security alerts. The use of Claude software themes in lures for the Honduras campaign further highlights the attackers' efforts to blend in with legitimate software and services.
TriBack Loader itself is delivered as a small package comprising a signed program, a malicious DLL, and an encrypted data file. After an initial decryption step, the malware executes its payload using unusual Windows callbacks. Researchers observed four variants of the loader over approximately two months, each featuring different host binaries and callback mechanisms but maintaining the same builder style. Two variants were found to deploy AdaptixC2 beacons, while a third delivered a backdoor known as Beagle, indicating a modular approach to payload delivery.
The geographical spread of the victims, from Southeast Asia to Latin America, aligns with patterns often associated with state-sponsored cyberespionage originating from China. The attackers also leveraged domains that followed a consistent registration pattern for their command and control (C2) infrastructure, further aiding attribution efforts. The exposed staging server also contained port forwarders, SOCKS tunnels, and network scanners, tools used to maintain persistence and evade detection within compromised networks.
Defenders are advised to block identified malicious domains and IP addresses at the network edge and DNS layers. Specific hunting indicators include looking for nested folders named like _CL followed by digits in mail and endpoint logs, and flagging signed vendor binaries that launch from user-writable paths when a companion data or log file is present nearby. Prioritizing patches for internet-facing Java applications and addressing unpatched critical vulnerabilities are also crucial mitigation steps. The broader context of Chinese APT campaign activity often involves shared loaders and tunneling tools, making TriBack a significant hunting anchor.
This new report from Group-IB details the specific infection chains and payloads employed by the JadeProx threat cluster, including the use of a new, undocumented Windows loader named TriBack Loader. The investigation uncovered active intrusions against a Vietnamese public hospital and Malaysia's Ministry of Foreign Affairs, alongside scanning efforts targeting Hong Kong education infrastructure and a spear-phishing campaign aimed at the National Congress of Honduras. The article also highlights four specific CVEs exploited by the operators, including CVE-2021-31755 affecting Tenda AC11 routers, which is already on CISA's Known Exploited Vulnerabilities catalog.