JadeProx China-Nexus Operation Using TriBack Loader

JadeProx is an active China-nexus threat cluster targeting government, healthcare, and educational sectors in Southeast Asia (Vietnam, Malaysia, Hong Kong) and Latin America (Honduras, Venezuela). An operational security error involving an exposed Alibaba Cloud directory revealed the group's full post-exploitation toolkit and active intrusion paths, including attacks on a Vietnamese hospital and the Malaysian Ministry of Foreign Affairs.

The group utilizes a custom shellcode loader termed TriBack Loader, which employs DLL sideloading and Win32 callback APIs to execute secondary payloads like AdaptixC2 and the Beagle backdoor. Their tradecraft is characterized by the abuse of legitimate signed binaries (Microsoft, G DATA) and the use of sophisticated phishing portals impersonating government tax systems and AI platforms to harvest credentials.

This activity represents a significant regional espionage threat, leveraging shared China-nexus tooling such as iox, fscan, and Neo-reGeorg. The high level of evasion techniques used in TriBack Loader, combined with the exploitation of high-severity vulnerabilities (CVE-2018-11511, CVE-2021-24139), underscores the group's technical proficiency and the urgency for targeted sectors to implement defensive countermeasures.