China-Nexus Hackers Breached Hospital X-Rays, Embassy, and Congress With New ...

A China-linked espionage operation compromised a Vietnamese public hospital's X-ray and MRI imaging system, tunneled through Malaysia's Ministry of Foreign Affairs network, and sent malware to Honduras's National Congress — all using a custom Windows loader that none of the major endpoint security vendors had previously documented, according to Group-IB's full technical breakdown published on July 23, 2026. Cybersecurity firm Group-IB stumbled onto the operation through an unusual stroke of luck: the hackers forgot to disable directory listings on their own command server.

The cluster, which Group-IB tracks as JadeProx, used a loader it calls TriBack Loader — a tool that cycles through four distinct Windows callback APIs specifically chosen because standard endpoint detection and response (EDR) products don't instrument them as closely as they do more common thread-creation calls. The practical result is that even organizations running modern EDR tools may not have flagged the infections.

There is a direct consumer dimension here that extends well beyond the governments and hospitals targeted. The same malware chain appeared on a phishing website impersonating Anthropic's Claude AI product at the domain claude-pro.com, registered March 28, 2026. Sophos, which investigated the fake Claude site independently , assessed that it was likely part of an active malvertising campaign — meaning it may have been served as a paid result to anyone searching for Claude AI software downloads since late March 2026. The malware that a user would have downloaded from that link is the same tool chain that penetrated a hospital's diagnostic imaging infrastructure.

Group-IB found the staging server — IP address 43.106.71[.]28, hosted on Alibaba Cloud's Singapore region — in mid-April 2026. A Python HTTP server had been left running on port 8000 with directory listing enabled, meaning the folder contents were visible to anyone who found the address.

What the open directory contained was unusually complete: the server's bash command history laid out an active campaign in step-by-step detail. Tunneling commands documented active intrusion attempts against a Vietnamese hospital's Picture Archiving and Communications System (PACS) — the infrastructure that stores and distributes patient X-rays, CT scans, and MRI images across a hospital's clinical network. Alongside those were records of multiple sessions against Malaysia's Ministry of Foreign Affairs, a bulk vulnerability scan of 14,653 Hong Kong education-sector URLs, and a completed phishing archive addressed to Honduras's National Congress.

All of the tools the operators needed were also present: tunneling software (iox, suo5, Neo-reGeorg), an open-source vulnerability scanner (Nuclei), a network scanner (fscan), four distinct builds of TriBack Loader, post-exploitation frameworks, and a modified version of a script called fuckaliyun.sh — a tool specifically designed to disable Alibaba Cloud's own host security monitoring agent on the same server the operators were using. The server also staged an XMRig cryptocurrency mining relay and a SOCKS5 proxy binary, suggesting an idle-monetization layer running alongside the primary intelligence-collection mission.

The staging server had gone offline by the time Group-IB's report was published on July 23, 2026.

The Vietnamese hospital intrusion shows the full technical chain in operation. The attackers identified an exposed Java Management Extensions (JMX) interface on one of the hospital's public-facing subdomains — a Java monitoring endpoint that is rarely hardened and often left accessible from the internet. They planted webshells through that interface, then used the suo5 tunneling tool to route traffic through the planted webshells directly into the hospital's internal PACS network.

The bash history recorded at least two distinct suo5 tunneling sessions against the hospital, targeting different subdomains, indicating the operators were persistent and had multiple footholds. The PACS system stores medical imaging for every patient the hospital serves. Access to that system grants visibility into diagnostic records, patient identity, and treatment history — data with direct intelligence value for a state actor seeking to profile government officials, military personnel, or foreign nationals who receive care there.

The Malaysian Ministry of Foreign Affairs intrusion followed a similar pattern : webshells planted, tunneling tools deployed. The first attempt failed because of a missing software dependency; the operators debugged the problem and tried again successfully. Diplomatic communications of a foreign ministry represent precisely the kind of intelligence a state- espionage actor would collect.

While the hospital and embassy intrusions were hands-on, targeted operations, the Hong Kong campaign operated at a different scale . The operators fed a list of 14,653 URLs covering Hong Kong's education sector into Nuclei, configured to surface only critical-severity vulnerabilities. The automated scan identified 13 unique vulnerabilities across the education infrastructure, and the operators followed up with manual exploitation attempts.

Four specific Common Vulnerabilities and Exposures (CVEs), each carrying a base score of 9.8 out of 10 on the Common Vulnerability Scoring System (CVSS), were used in the follow-up exploitation: CVE-2018-11511 (a SQL injection flaw in ASUSTOR ADM photo gallery software), CVE-2021-24139 (a SQL injection flaw in the 10Web Photo Gallery WordPress plugin), CVE-2021-31755 (a stack buffer overflow in Tenda AC11 routers), and CVE-2021-32305 (arbitrary command execution in WebSVN) . The Hacker News independently confirmed all four against the National Vulnerability Database on July 23, 2026 . All four were disclosed between 2018 and 2021 and are exploitable today only on systems that have not applied patches available for years.

The Tenda AC11 flaw (CVE-2021-31755) has been on the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog since November 3, 2021, with a federal remediation deadline that expired two weeks after listing. Any U.S. federal agency still running vulnerable Tenda devices would be in violation of its mandatory patching obligations.

The phishing domain claude-pro.com was registered on March 28, 2026 and hosted a site that imitated Anthropic's Claude AI product page . Visitors who clicked the download link received a file called Claude-Pro-windows-x64.zip, containing a malicious MSI installer.

Running the installer triggered a User Account Control (UAC) prompt. After the user approved, the installer placed three files into the Windows Startup folder to ensure persistence across reboots: a legitimate, digitally signed binary (in this case, avk.exe, a real G DATA security software component), a malicious DLL masquerading as the legitimate version (avk.dll), and an encrypted payload file. A VBScript orchestrated the installation, and a self-deleting batch file with a double extension (.vbs.bat) erased itself two seconds after execution to reduce forensic traces.

The backdoor installed through this chain — called Beagle by Sophos, which first documented it — communicated with a command-and-control server at license[.]claude-pro[.]com . Beagle is a relatively simple but complete remote-access tool capable of executing commands, uploading and downloading files, managing directories, and uninstalling itself. Its simplicity may be deliberate: a minimal footprint reduces the chances of behavioral detection.

Sophos assessed the campaign as likely malvertising — meaning the fake site was probably as a paid result. If that assessment is accurate, anyone who typed "Claude AI download" or similar terms into a engine and clicked a link during the active window of the campaign may have encountered the installer. The legitimate Claude download is available only through Anthropic's official site at claude.ai.

Every infection chain in the JadeProx operation runs through TriBack Loader. Group-IB identified four distinct builds of the tool , all sharing the same core architecture but rotating key components — in a pattern consistent with a custom builder tool that automates variant production rather than requiring the operators to manually construct each one.

The consistent elements across all four variants establish what Group-IB calls a three-file sideloading triad: a legitimate, digitally signed vendor binary, a malicious DLL placed in the same directory, and an encrypted payload file. When the legitimate binary runs, Windows locates the malicious DLL first — because it sits in the same directory — and loads it into the legitimate process's memory space. Because the loading process is a trusted, signed application, many security tools pass it without inspection.

The malicious DLL then performs two-stage decryption on the payload file: first reversing all bytes, then applying a rolling XOR with a key derived from a hardcoded string. Group-IB noted this two-stage decryption pattern "appears frequently in loaders associated with Chinese APT groups." The result is shellcode that the DLL must then execute — and this is where the four variants diverge.

Standard endpoint security products most heavily instrument a small number of Windows APIs associated with thread creation and memory execution, particularly CreateThread and VirtualAlloc with execute permissions. TriBack Loader's four variants each use a different API to execute the shellcode, all chosen specifically because they receive less scrutiny:

Variant 1 uses InitOnceExecuteOnce, a Windows one-time initialization API designed for ensuring code runs only once. Group-IB wrote that "The Windows one-time initialization API is rarely monitored by EDR solutions compared to direct CreateThread or VirtualAlloc with execute patterns." Variant 2 registers the decrypted payload as a TimerQueue callback — a timer event rather than a thread — which avoids the CreateThread hooks that most security products instrument. Variant 3 uses EtwpCreateEtwThread, an undocumented thread-creation function inside ntdll.dll that the loader retrieves at runtime using GetProcAddress , making it invisible to static analysis tools that would detect a direct API call. Sophos independently confirmed the same EtwpCreateEtwThread technique in samples linked to the fake Claude site. Variant 4's final payload was never recovered — the encrypted companion file was absent from available samples.

The signed host binary also changes between variants: Variants 1 and 2 use a Microsoft Service Hub component; Variant 3 uses avk.exe (the G DATA security binary described above); and Variant 4 uses MpCopyAccelerator.exe, a Microsoft Malware Protection utility associated in prior research with Mustang Panda's delivery chains .

Variants 1 and 2 deliver AdaptixC2 , an open-source post-exploitation framework that provides the attacker with a persistent remote foothold. Group-IB fully decrypted both beacon configurations from the exposed server, recovering the C2 domain addresses, HTTP communication profiles, and sleep intervals. One AdaptixC2 configuration contained a GitHub analytics session cookie that Group-IB identified as linking the build to a custom beacon profile previously documented in connection with Tropic Trooper , a known China-nexus group — though Group-IB stops short of equating the two clusters. Variant 3 delivers Beagle through DonutLoader, as described above.

The JadeProx infrastructure served two functions simultaneously. The Honduras AdaptixC2 domain hosted a live credential harvesting portal that impersonated the tax administration system for Piar Municipality in Venezuela's Bolívar state. The portal appeared to offer full municipal tax services and prompted visitors who created accounts to upload sensitive financial and personal documents. Venezuela's Bolívar state has documented Chinese economic interests in its mining sector.

A second IP associated with the Claude-Pro campaign pointed to a fake professional services firm, "Vertex Trust Advisors," apparently mimicking the Singapore-based Vertex Holdings. The fake site listed services across employment, legal, and risk management. These realistic-looking cover sites reduced the suspicious profile of the infrastructure in automated domain reputation systems — a domain hosting a plausible-looking professional services page draws less automated scrutiny than a domain hosting only malware.

All identified domains were registered through NameSilo, with several fronted through Cloudflare. Infrastructure was distributed across Cloudflare, DigitalOcean, Alibaba US, and a CTG Server-hosted IP. Three domains — update-trellix[.]com, update-crowdstrike[.]com, and update-sentinelone[.]com — impersonated endpoint security vendors and shared a single IP address .

Group-IB explicitly declined to attribute JadeProx to any specific named threat group , and the report explains the methodology behind that decision. The tooling — iox, fscan, suo5, Neo-reGeorg, AdaptixC2, the broader approach of webshell-based tunneling — is widely shared across the China-nexus APT ecosystem. Overlaps exist with Mustang Panda (signed-binary DLL sideloading, MpCopyAccelerator.exe), Earth Lusca (the hands-on post-exploitation toolkit), UAT-5918 (government and education targeting in Asia), and Tropic Trooper (the AdaptixC2 GitHub session cookie linkage). But no single documented cluster accounts for the complete picture.

The infrastructure anchors the cluster in China : Alibaba Cloud hosting, an Alibaba OSS bucket in mainland China used to stage binaries, Chinese-language MSI installer strings, and the deliberate use of fuckaliyun.sh to evade Alibaba's own security monitoring. Group-IB maintains JadeProx as a distinct tracking cluster to avoid premature attribution while preserving a clean record of the operation's specific artifacts for future correlation.

The Honduran phishing archive (Estado de Cuenta.zip) used a decoy document imitating a payment notice from Cervecería Hondureña — a major Honduran beverage company — for approximately 57,000 Honduran Lempiras (approximately $2,129 USD at a July 23, 2026 exchange rate of 1 USD = 26.7773 HNL; exchange rate as of July 23, 2026, conversion is approximate), according to Group-IB's analysis .

Group-IB's defensive guidance focuses on the sideloading chain's structural footprint , which remains stable even as filenames, signed binaries, and C2 addresses rotate:

Flag signed vendor binaries running from user-writable directories, temporary folders, or the Windows Startup folder — particularly when an encrypted .dat or .log file sits in the same directory. Investigate unexpected appearances of hostfxr.dll, avk.dll, or MpClient.dll in non-standard paths. Look for nested CL ###### folder structures and the ~del.vbs.bat double-extension self-deleting artifact.

Block or investigate the cluster's known network indicators: claude-pro[.]com, license[.]claude-pro[.]com, sylverixstrategy[.]com, gouvvbo[.]top, vertextrust-advisors[.]com, update-trellix[.]com, update-crowdstrike[.]com, update-sentinelone[.]com, and the original staging server IP 43.106.71[.]28.

Prioritize patching internet-facing Java applications, and treat any public-facing system with an unpatched CVSS 9.8 vulnerability as an active risk, particularly the four CVEs exploited in this campaign. Alert on MSI installers that perform custom VBScript actions placing files into the Windows Startup folder.

Group-IB has shared full indicators of compromise, file hashes, and MITRE ATT&CK technique mappings on its Threat Intelligence portal.

JadeProx illustrates a pattern that has become characteristic of China-nexus espionage: technically sophisticated custom tooling layered on top of publicly available frameworks, targeted against institutions — hospitals, foreign ministries, legislatures, education systems — whose data holds direct intelligence value for a state actor. What made this operation unusually visible was an avoidable mistake. An open Python HTTP server handed Group-IB a complete view of an active campaign that might otherwise have remained invisible for months longer.

For the general user, the takeaway is more immediate: a state- espionage malware chain was actively distributed as a fake AI software download in the spring of 2026. If your system has unexplained startup entries involving avk.exe, NOVUpdate.exe, or hostfxr.dll outside of their expected installation directories, treat it as a potential indicator and investigate using the published file hashes.

Organizations in healthcare, government, education, and diplomatic sectors across Southeast Asia and Latin America should treat the published IOCs as active threats until confirmed otherwise.

The malware placed three files in the Windows Startup folder: a legitimate-looking vendor binary (avk.exe from G DATA antivirus, or a Microsoft Service Hub component), a malicious DLL (avk.dll or hostfxr.dll), and an encrypted payload file (.dat or .log). If you downloaded a Claude AI installer from any source other than claude.ai and approved a UAC prompt, check your Windows Startup folder (typically C:Users[username]AppDataRoamingMicrosoftWindowsStart MenuProgramsStartup) for unexpected executables. Group-IB has published specific file hashes for known malicious files on its Threat Intelligence portal.

Most endpoint security products instrument a specific set of Windows APIs associated with thread creation — primarily CreateThread and related calls. TriBack Loader avoids all of those. Its four variants use InitOnceExecuteOnce (a Windows initialization utility API), TimerQueue callbacks (which register execution as a timer event), and EtwpCreateEtwThread (an undocumented ntdll function retrieved at runtime, invisible to static analysis). Each of these APIs has legitimate uses and receives comparatively little EDR monitoring. Executing shellcode through them produces less behavioral signal than the execution paths most security tools prioritize.

Medical imaging records hold significant intelligence value for state actors beyond their clinical function. A hospital's PACS system contains diagnostic images for every patient the institution has treated. For a state intelligence service, that includes records for government officials, military personnel, and foreign nationals. Medical histories can be used to profile individuals, identify vulnerabilities, or build targeting profiles for operations that have nothing to do with healthcare. This is consistent with a documented pattern of China-nexus APT groups targeting healthcare data alongside diplomatic and government information in the same operations.

All four CVEs exploited — CVE-2018-11511, CVE-2021-24139, CVE-2021-31755, and CVE-2021-32305 — were disclosed between 2018 and 2021 and have patches available. The Tenda AC11 flaw (CVE-2021-31755) has been on CISA's Known Exploited Vulnerabilities catalog since November 2021, with a federal remediation deadline that has long since passed. These vulnerabilities remain exploitable only on systems that have not applied years-old patches. The fact that JadeProx was successfully exploiting them in 2026 indicates that a meaningful of the 14,653 education-sector URLs they scanned had still not been patched.