# JadeProx Targets Government and Healthcare with TriBack Loader China-linked cyberattacks employ a new Windows loader. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-07-23 - **Topic:** [Business](https://brifing.si/c/business) - **Original article:** - **On Brifing:** https://brifing.si/s/f3de9ed8-6c99-4777-8fb9-324382e23fc8 ## JadeProx's New Weapon: TriBack Loader The China-linked JadeProx operation targeted government, healthcare, and education organizations using a new Windows loader called TriBack Loader. The attacks occurred across Asia and Latin America. A server discovered on Alibaba Cloud revealed the details of the operation. ## Targets and Methods JadeProx breached a Vietnamese public hospital's medical imaging system and Malaysia's Ministry of Foreign Affairs. Hong Kong's education infrastructure was also scanned, and a spear-phishing package was prepared for Honduras' National Congress. Attackers accessed the hospital server through webshells. ## Technical Details of TriBack Loader TriBack Loader creates four different infection chains using DLL sideloading. Most builds include a signed executable, a malicious DLL, and an encrypted .dat or .log payload. The DLL reverses the payload, XORs it, and executes it via Win32 calls. ## AdaptixC2 and Beagle Backdoor Two TriBack Loader variants delivered AdaptixC2, an open-source post-exploitation framework. A Claude-themed variant used DonutLoader to execute the Beagle backdoor, first documented by Sophos. The payload of the fourth variant remains unknown. ## Spear-Phishing and Malvertising JadeProx used a fake beverage company account statement and a malicious MSI installer impersonating Anthropic's Claude software. The installer placed itself in the Windows Startup folder for persistence. Sophos identified the XOR key from the fake site and infrastructure. ## Security Measures and Detection Sophos and Group-IB recommend monitoring file layouts and signed executables for detection. Attention should be paid to encrypted files in user-writable, temporary, or Startup folders. The domains and IPs used by the attackers should be blocked. ## Sources covering this story - https://thehackernews.com/2026/07/china-nexus-jadeprox-uses-new-triback.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._