Jadeprox China Nexus Triback Loader

An open directory and a SEA of victims reaching as far as LATAM all lead to TriBack Loader.

In mid-April 2026, an exposed directory on an operator-owned Alibaba Cloud server gave us a complete view into an active China-nexus operation. The server with bash history, toolkits, webshell paths against victims, and staged phishing packages were all visible. The investigation uncovered simultaneous intrusions against a Vietnamese public hospital’s medical imaging system, the Malaysian Ministry of Foreign Affairs, and multiple Hong Kong educational institutions. Running in parallel, similar targeting of Honduras and phishing campaigns themed around fake Anthropic Claude software were observed.

At the centre of all these campaigns is a loader Group-IB tracks as TriBack Loader , triggered via DLL sideloading that decrypts and executes shellcode payloads using Win32 callback APIs to avoid detection. Two observed variants deliver AdaptixC2, while a third variant delivers Beagle , a backdoor documented recently with the domains being registered under NameSilo . A live phishing portal impersonating a municipal tax system of Venezuela was also found running among other fake portals. We track this cluster as JadeProx with TTPs overlapping with multiple China-nexus groups.

Group-IB customers can access our Threat Intelligence portal for more information the threat actor and malware described in this blog:

Figure 1. Attack Chain and Infrastructure.

Targeted countries in this campaign span South-East Asia, Latin America, and beyond. Vietnam, Malaysia, and Hong Kong are consistent targets across multiple documented China-nexus operations and represent recurring patterns of regional espionage activity. Honduras was targeted through a lure impersonating a major local beverage company addressed to its National Congress. The Venezuelan portal impersonated a real municipal tax administration system for a specific jurisdiction, suggesting deliberate selection rather than opportunistic deployment.

Figure 2. JadeProx victimology map.

The operator exposed their server 43.106.71[.]28:8000 by leaving a Python HTTP server running on port 8000 with directory listing enabled. The server was hosted on an Alibaba Cloud Singapore instance with an open SSH port; it is no longer active at the time of writing.

Figure 3. Open directory listing on an operator server.

The following toolkits were observed on the exposed server:

Figure 4. Deploying fuckaliyun.

The observed fuckaliyun script is slightly modified from the well-known repository; it additionally installs iptables if not found, plus:

3.1. Removes call to rescue_localhost_name – this confirms that operators own the Alibaba staging server account and just want to hide it from Alibaba’s security products; as it’s easy to track instances by hostname. 3.2. Adds 2 functions that are never called 3.2.1 . start_socks5() – download a Go-based ELF binary from their own Alibaba OSS bucket and run it as a background daemon via nohup command. Analysis shows this is compiled from – 3.2.2 . start_proxy() – clones xmrig-proxy and builds it from source. This relay component combines multiple workers to hide behind a single pool. This suggests an idle phase after active operational use of SOCKS5 proxy.

Figure 5. Additions to fuckaliyin script.

4. Downloads iox directly from github. 5. Experiment with iox port combinations and encryption key. 6. Multiple screen sessions created for iox, suggesting simultaneous host compromise. 7. Here, a binary named ‘linux_amd64’ is removed. Upon analysis, this is a garbled version of NPS . This is a proxy server that can forward all traffic and access intranet, it also uses multiplexing implementation for connection. 8. fscan binary is renamed to sys.log.

Figure 6. Garbled version of NPS.

9. suo5 v2.1.0 downloaded directly from github. 10. Two attempts against the same hospital’s PACS server in Vietnam with different webshells. JMX path (Java Management Extensions) exploited is a Java monitoring interface. 11. Another subdomain of same hospital was also compromised with the same shell, exploiting a Java based application, though a different port was used for tunneling.

Figure 7. Execution of suo5 against PACS

12. Downloads Neo-reGeorg tunnel directly from github again. 13. Failed in first attempt to compromise Malaysian MFA. 14. Dependency curl-cffi is installed after debugging to establish webshell in another attempt. 15. Netcat reverse shell listeners started with multiple failed attempts via different ports.

Figure 8. Execution of Neo-reGeorg against a Malaysian government department.

16. Observed HK education sector list contains 14,653 URLs under targets.txt file. The list is generated through automation as it has duplicate entries, sub-domains and 117 different service ports including RDP, SSH, FTP, MySQL beyond standard web ports. The list includes whois services, domain registrars, eduGAIN and CDN endpoints, majority of IP targets from Hong Kong, and few *.hk domains. Also included are a small cluster of suspicious AI-themed wealth and stock trading ai***.top domains that are registered between Nov-2025 and Feb-2026 through XinNet Technology Corporation. 17. Install nuclei from github via golang and symlink creation, extract only critical severity templates for focused scanning and launch bulk scan with silent flag.

Figure 9. Execution of nuclei against multiple targets in Hong Kong.

18. The output.txt file points to 13 unique vulnerabilities present on these education domains. These vulnerabilities target network hardware, enterprise appliances, and web software to exploit command or memory flaws, SQL Injection, etc.

Figure 10. Scanning results from the execution of nuclei against multiple targets in Hong Kong.

19. Individual exploitation follow-up 19.1. CVE-2018-11511 – SQL injection in the tree list in the photo gallery application in ASUSTOR ADM (photo.pokok[.]edu[.]hk) – [CVSS 9.8]. 19.2. CVE-2021-24139 – SQL injection in the Photo Gallery (10Web Photo Gallery) WordPress plugin (pta.sfaeps[.]edu[.]hk) – [CVSS 9.8]. 20. Other CVEs utilized 20.1. CVE-2021-31755 – A stack buffer overflow vulnerability on Tenda AC11 devices – [CVSS 9.8]. 20.2. CVE-2021-32305 – WebSVN arbitrary command execution – [CVSS 9.8].

Figure 11. Nuclei usage with specific CVEs.

21. Failure to download Chromium browserstealer tool from github. 22. This tool targets Chrome’s App-Bound Encryption, a post-exploitation credential harvesting step. 23. bjh DLL sideload package staged and served.

Figure 12. Failure to fetch ChromElevator.

24. The bjh.zip DLL sideloading package is unzipped and served via HTTP on port 18989. 25. A dedicated screen -S httpserver session kept it running persistently. 26. This was being served to compromised Windows hosts likely delivered via the SOCKS tunnels into internal networks where the actor had pivot access.

Figure 13. Extracting PE payloads.

Four files are present in bjh.zip which has a modify date as recent as April ‎15, ‎2026 :

Figure 14. Contents of archive file.

Based on the EXE and DLL seen above, a similar campaign has been identified targeting Honduras on VirusTotal. An archive file “ Estado de Cuenta.zip ” is identified with 2026-03-18 as modification date and was uploaded from Honduras on 2026-03-25 containing the following files nested inside the folder named “ _CL_177387 ”.

Figure 15. Contents of Honduras archive.

The shortcut file with machine ID “ desktop-47cf5k7 ” triggers the VBS script which in turn pops the decoy and then triggers the same executable.

Figure 16. VBS script contents.

The decoy document imitates a Cervecería Hondureña (a major beverage company in Honduras) account statement for ~57,000 HNL, which looks like a payment notice from July 2025. The document timestamp 2025-07-14 also matches the same. The intended recipient is the National Congress of Honduras.

The signed binary used in this variant is Microsoft Service Hub (AnyCPU) CLR host, which sideloads the malicious DLL (hostfxr.dll).

The hostfxr.dll contains a decryption stub in the export function hostfxr_main_startupinfo where the routine has two-stages: byte reversal and rolling XOR with offset. This is a typical loader routine seen normally in many malwares used by Chinese APT groups. Once the DAT file is decrypted after a specific sequence of APIs called, the payload gets triggered. The XOR keys in the open directory and Honduras samples are respectively as:

Figure 18. Variant-1 of TriBack Loader.

The critical difference between the opendir and Honduras variant is how the final payload gets executed. The open directory sample uses InitOnceExecuteOnce API which is a known sandbox evasion technique. The Windows one-time initialization API is rarely monitored by EDR solutions compared to direct CreateThread or VirtualAlloc with execute patterns.

Figure 19. Variant-2 of TriBack Loader.

The Honduras sample uses a TimerQueue callback for execution, which is another EDR evasion technique. By registering the decrypted payload as a timer callback rather than a thread, it avoids CreateThread hooks that many security products monitor. With a simple decryption script, we extracted the final shellcode. Examining the shellcode stub which is 1023 bytes followed by MZ header starting at 0x3FF location, reveals this to be a reflective loader of the PE file.

Figure 20. Decrypting shellcode stub.

Debugging the final payload leads us to AdaptixC2 beacon, an open-source post-exploitation framework.

Figure 21. Domain of AdaptixC2 extracted.

The C2 identified in the open directory case is sylverixstrategy[.]com with the following HTTP configuration:

X-Beacon-Id: sVl9rKliaBp9mWruQqIqT3KRAkQ1SgKEebeF4X7hA/0gYq4SeF44nYLMrCi8hjvNJbm3W/o79gUWzkz1n7dvykcx6UjASIy6McMdMVcFnv949g+VmwzPuytQ+S/WDBlH5bqePzm4

We won’t be going into in-depth technical analysis of the framework as it has already been documented extensively, and recently as well.

Recent whois records indicate the C2 was created on 2026-03-13 during the same time when the malware was created. The C2 in the Honduras case is gouvvbo[.]top (2026-03-18) and both these domains have NameSilo as registrar. Recently, Tropic Trooper weaponized AdaptixC2 with a customer beacon listener. Though our beacons are not custom listeners, a GitHub analytics cookie is observed that links this to the custom beacon profile of Tropic Trooper.

Another archive with similar triad but different signed binaries has been identified (which has been blogged twice in the cybersecurity community, in April and May ). Uploaded from Japan and named “ Claude-Pro-Relay-Technical-Overview.zip ” with a 2026-04-04 modification date, it contains an additional bash script in its infection chain. The shortcut file has the same machine ID and MAC address seen in variant 2, but this uses ftp.exe to trigger the bash script instead of explorer.exe and has the same nested folder structure:

It triggers the decoy themed “Claude-Pro” and runs the VBS script. One more archive containing identical payloads was uploaded from Australia as well, though upload regions do not necessarily indicate it as a targeted country . The decoy in this case is a technical overview of how Claude-Pro works.

Figure 22. PDF decoy used in the Claude-Pro themed variant.

The VBS stager is similar, but this time drops all the payloads into the startup directory for persistence. The signed binary used is avk.exe, which is a G DATA Security Software application, and the same triad of EXE-DLL-DAT file can be seen. A similar G DATA binary has been used recently by Chinese APT to load PlugX malware.

Figure 23. VB script seen in Claude-Pro themed variant.

Once the EXE is triggered by the VBS, it sideloads the DLL loader which reads the DAT file. The same win32 API sequence can be seen, but this time EtwpCreateEtwThread is used, an undocumented API for stealthy thread creation to bypass AV/EDR. It is fetched from ntdll using GetModuleHandleA and GetProcAddress, but the interesting thing is the same XOR key from variant 2 is used in this loader. Export triggers in this is ModuleMain with a 2026-01-18 timestamp.

Figure 24. Variant-3 of TriBack Loader.

This version doesn’t load AdaptixC2 but analysis of the shellcode shows this to be DonutLoader, another shellcode loader that runs a never-before-seen backdoor termed Beagle . C2 observed in this case is license[.]claude-pro[.].com that gets resolved to 8.217.190[.]58, which has the same AS 45102 (Alibaba US Technology Co.) of the open directory IP address.

The triad observed here was also seen packaged as an MSI installer hosted on a phishing domain claude-pro[.]com registered on 2026-03-28. The final payload was first blogged recently as PlugX malware but doesn’t mention any analysis, instead it points to another Lab52 report from Feb 2026 with similar G DATA based DLL sideloading.

Figure 25. Phishing portal impersonating Claude-Pro with a link that downloads an MSI package.

A different archive with similar naming convention “ Claude-Pro-windows-x64.zip ” and modification date 2026-04-05 is hosted on it using NameSilo (3rd domain with the same registrar). The MSI installer contains a similar VBS (Claude.vbs). Interestingly, while the ZIP was uploaded from the UK, the installer uses Chinese language throughout the process.

After the UAC prompt, the installer creates a desktop shortcut to the VBScript inside ProgramFiles under SquirrelTemp directory. The VBS in turn creates another shortcut to trigger legitimate Claude binary after verification and sets up the same triad inside the startup folder to survive reboot in a similar fashion seen above. Additionally, a self-delete batch script with double extension “\~del.vbs.bat” is created to delete the VBS after 2 seconds.

Figure 27. Target VBS triggered by desktop shortcut.

Figure 28. Contents of target directory containing TriBack Loader.

Figure 29. VB script variant that self-deletes.

The domain observed in this case is the same as above, license[.]claude-pro[.]com . Apart from the “ Claude.msi ” file seen in the archive, another standalone MSI has been identified named “ GolddTV.msi ” which is uploaded from Algeria. It has the identical triad payloads, but no VBS or shortcut is seen in the installation sequence and a different C2, update-trellix[.]com that resolved to 192.252.186[.]62 communicating on port 8080.

Figure 30. Another MSI installer with TriBack Loader.

Based on the XOR key seen in both variants 2 and 3, we pivoted to another archive uploaded from Taiwan. Named “ DeviceSync.zip ” and modification date 2026-02-13, it contains only an EXE and DLL. The signed binary used here is MpCopyAccelerator.pdb (Microsoft Malware Protection Copy Accelerator Utility), which is seen to be used by Mustang Panda a lot.

The loader seen is almost identical except that the .log file is searched in the ProgramData directory, meaning it is dropped prior to this archive file by some stager. It uses the same API sequence, XOR key and callback function. Since the LOG file is not available, the final payload cannot be determined.

Figure 31. Another TriBack Loader payload.

Based on the repeated API sequence in all the four variants of TriBack loader, this is likely generated by a custom builder. Proofpoint published recently on a new PlugX variant with multiple DLLs sideloaded by signed binaries.

Figure 32. JadeProx cluster infrastructure correlation as seen on Group-IB Graph.

The domains identified in our investigation are all registered under NameSilo with few having Let’s Encrypt issuer and associated with CloudFlare Origin certificates.

update-crowdstrike[.]com

update-sentinelone[.]com

In the Honduras case, the C2 has a login page observed recently that impersonates Piar Municipality in the Venezuelan state of Bolivar. It presents itself as a comprehensive administrative and tax management service, but is a phishing portal running on the C2 used for the AdaptixC2 beacon. The official website of Alcaldía Bolivariana del Municipio Piar looks completely different and is used for municipal tax collection under Superintendency of Tax Administration of the Municipality Piar.

Figure 33. Phishing portal impersonating Municipality Piar.

Creating a random account gets us into the portal, directing us to complete the profile and upload necessary documents such as RIF, last payment receipt, certificates, etc. along with personal information.

Figure 34. Successful login into the fake portal.

Figure 35. Data fields present on download page.

The website doesn’t have any proper terms or privacy statement, but provides an option to download the tax credit statement in various file formats as a decoy.

The Claude-Pro themed variant’s phishing domain on the other hand is linked to an IP (178.128.108[.]89) that points to a website titled “ Vertex Trust Advisors ”. This is another fake website “ vertextrust-advisors[.]com ” created in April 2026 which is likely mimicking Vertex Holdings, a global financial services group based in Singapore.

The fake website uses a Singapore address and lists various professional services such as Employment Lifecycle Compliance, Organizational Talent Strategy, Corporate Risk Management and Specialized Legal Advisory.

Figure 36. Fake portal impersonating Vertex.

The phishing infrastructure serves two purposes beyond hosting C2 endpoints. First, it provides cover: legitimate-looking websites on the same domains make the infrastructure appear less suspicious to automated reputation systems and casual inspection. Second, the portals actively collect credentials and personal data from targets who interact with them.

Cross-referencing compilation timestamps, ZIP modify dates, and domain registration dates across all the indicators reveals a consistent build that ties everything together. The earliest artifact, avk.dll, predates the open directory discovery by nearly three months, placing the start of active development in January 2026. February focuses on the DeviceSync-MpClient variant while March month has another hostfxr.dll build, two AdaptixC2 beacons compiled within days along with ZIP archive. The bjh.zip and Linux binary timestamps in April, align with the staging server activity captured in the open directory.

2026:04:04 20:02:06 UTC

Various Chinese-origin tools listed in this operation have been weaponized by multiple China-nexus APTs, and the use of loaders to execute final payloads is consistent tradecraft across that ecosystem. The Chinese-language MSI installer and infrastructure pattern – NameSilo registrar, Cloudflare fronting, Alibaba hosting further confirm China-nexus origin.

The trident DLL sideloading with signed binaries overlaps with Mustang Panda ’s documented PlugX delivery and the callback-API loader execution style with the ClaimLoader family. The hands-on post-exploitation toolkit (iox, fscan, suo5, Neo-reGeorg, etc.) is consistent with Earth Lusca and UAT-5918 operations among others targeting government and education sectors across Asia. An open directory with similar Chinese-origin toolset was linked to APT27 (Emissary Panda), whereas an updated TOSHIS loader used by Tropic Trooper to deploy AdaptixC2 with custom GitHub listener.

However, no single group accounts for the full picture. The loader family, delivery infrastructure, lure themes, and targeting profile together do not match any one documented cluster. In the China-nexus ecosystem, tooling is routinely shared across groups and the presence of the same tools does not mean the same operator. We track this activity as JadeProx to avoid misattribution and to maintain a clean record of this cluster’s specific artifacts as new activity emerges. The TriBack Loader, its XOR key variants, and the associated infrastructure remain the most reliable anchors for future correlation.

JadeProx operates by conducting phishing campaigns delivering Windows loaders for initial access, tunnelling tools maintaining persistence across compromised networks, and custom Go-based relay infrastructure keeping the operator’s traffic hidden behind Alibaba and Cloudflare. The OPSEC failure on the staging server gave us a rare complete view of the operation and the targets across South-East Asia. The same builder produced four loader variants across two months, the same infrastructure pattern repeated across domains, and the signed-binary abuse technique ran across three different vendor binaries.

Attribution sits firmly in the China-nexus ecosystem as TTP overlaps with multiple such groups consistent with the shared model well-documented across Chinese APT clusters. We track this separately as JadeProx and the loader as TriBack Loader.

A loader in cybersecurity is a specialized malware component designed to deliver, decrypt, and execute secondary payloads (such as backdoors, Command and Control beacons, or shellcode) directly into memory on a targeted system.

In the context of the JadeProx operation, the loader acts as an initial execution mechanism that decrypts encrypted payload files stored on disk and executes them stealthily using legitimate Win32 callback APIs to evade detection by Endpoint Detection and Response (EDR) software.

TriBack Loader is a custom loader identified by Group-IB that exhibits the following key characteristics: a three-file triad structure, DLL sideloading, two-stage decryption, Win32 Callback API execution, minimal host footprint, and payload delivery of secondary threats such as the AdaptixC2 beacon framework and the Beagle backdoor.

The investigation identified four variants of TriBack Loader, distinguished by their signed host binaries, callback mechanisms, and targeted execution methods:

Based on extensive tradecraft, infrastructure patterns, tooling, and TTP overlaps across other documented Chinese APT groups:

8002ab4d0cf7e1888ee72de0b9f4282c

DISCLAIMER: All technical information, including malware analysis, indicators of compromise and infrastructure details provided in this publication, is shared solely for defensive cybersecurity and research purposes. Group-IB does not endorse or permit any unauthorized or offensive use of the information contained herein. The data and conclusions represent Group-IB’s analytical assessment based on available evidence and are intended to help organizations detect, prevent, and respond to cyber threats.

Group-IB expressly disclaims liability for any misuse of the information provided. Organizations and readers are encouraged to apply this intelligence responsibly and in compliance with all applicable laws and regulations.

This blog may reference legitimate third-party services such as Alibaba Cloud, Cloudflare, Claude, and others, solely to illustrate cases where threat actors have abused or misused these platforms.

This material is provided for informational purposes, prepared by Group-IB as part of its own analytical investigation, and reflects recently identified threat activity.

All trademarks referenced herein are the property of their respective owners and are used solely for informational purposes, without any implication of affiliation or sponsorship.