JadeProx: China-nexus TriBack Loader Campaign Analysis

In mid-April 2026, an operational security (OPSEC) failure involving an exposed Alibaba Cloud directory revealed the inner workings of a China-nexus campaign tracked as JadeProx. The activity involves simultaneous intrusions against government, healthcare, and educational sectors in Vietnam, Malaysia, Hong Kong, Honduras, and Venezuela. The group uses a custom toolset to scan for vulnerabilities, pivot through internal networks, and establish persistent access using various legitimate proxy tools and backdoors.

The technical core of this operation is the TriBack Loader, which utilizes DLL sideloading to decrypt shellcode payloads using Win32 callback APIs. This stealthy execution method is designed to bypass endpoint detection and response (EDR) solutions by avoiding standard thread creation hooks. JadeProx demonstrates a high degree of adaptability, rotating host binaries and XOR keys across at least four identified variants of the loader.

This threat is significant due to its broad geographical reach and the reuse of tradecraft from known Chinese APT groups like Mustang Panda and Tropic Trooper. The group's ability to weaponize current themes, such as AI-software (Anthropic Claude) lures and municipal tax portals, highlights a sophisticated social engineering capability aimed at high-value government and institutional targets.