JadeProx Targets Government and Healthcare with TriBack Loader
China-linked cyberattacks employ a new Windows loader.
1JadeProx's New Weapon: TriBack Loader
The China-linked JadeProx operation targeted government, healthcare, and education organizations using a new Windows loader called TriBack Loader. The attacks occurred across Asia and Latin America. A server discovered on Alibaba Cloud revealed the details of the operation.
2Targets and Methods
JadeProx breached a Vietnamese public hospital's medical imaging system and Malaysia's Ministry of Foreign Affairs. Hong Kong's education infrastructure was also scanned, and a spear-phishing package was prepared for Honduras' National Congress. Attackers accessed the hospital server through webshells.
3Technical Details of TriBack Loader
TriBack Loader creates four different infection chains using DLL sideloading. Most builds include a signed executable, a malicious DLL, and an encrypted .dat or .log payload. The DLL reverses the payload, XORs it, and executes it via Win32 calls.
4AdaptixC2 and Beagle Backdoor
Two TriBack Loader variants delivered AdaptixC2, an open-source post-exploitation framework. A Claude-themed variant used DonutLoader to execute the Beagle backdoor, first documented by Sophos. The payload of the fourth variant remains unknown.
5Spear-Phishing and Malvertising
JadeProx used a fake beverage company account statement and a malicious MSI installer impersonating Anthropic's Claude software. The installer placed itself in the Windows Startup folder for persistence. Sophos identified the XOR key from the fake site and infrastructure.
6Security Measures and Detection
Sophos and Group-IB recommend monitoring file layouts and signed executables for detection. Attention should be paid to encrypted files in user-writable, temporary, or Startup folders. The domains and IPs used by the attackers should be blocked.