Full Report
An exposed Alibaba Cloud server has revealed a China-nexus operation that Group-IB tracks as JadeProx. The cluster has targeted government, healthcare, and education organizations across Asia and Latin America with a previously undocumented Windows loader called TriBack Loader. Group-IB found the server in mid-April 2026 in Alibaba Cloud's Singapore region; it was offline by the time the report
Analysis Summary
# Threat Actor: JadeProx
## Attribution & Identity
- **Actor Name:** JadeProx
- **Attribution:** China-nexus operation.
- **Note on Attribution:** Group-IB notes that while the tooling overlaps with known China-nexus ecosystems, the sharing of tools among different operators makes definitive attribution to a specific established APT difficult.
## Activity Summary
JadeProx is a cyber-espionage cluster identified in mid-April 2026 following the discovery of an exposed Alibaba Cloud server in Singapore. The actor has been active since at least February 2026, conducting intrusions involving webshell deployment, vulnerability scanning, and spear-phishing campaigns. Notable activities include breaching a Vietnamese hospital's imaging system and targeting the Malaysian Ministry of Foreign Affairs.
## Tactics, Techniques & Procedures
- **Initial Access:**
- Exploitation of exposed Java management interfaces to plant webshells.
- Spear-phishing via malicious archives (lures include fake beverage account statements and Claude AI installers).
- Malvertising (suspected) via fake software download sites.
- **Persistence & Execution:**
- **DLL Side-Loading:** Pairing legitimate signed executables with malicious DLLs to load encrypted payloads (`.dat` or `.log`).
- Placement of malicious binaries in the Windows Startup folder.
- **Evasion:**
- Use of Win32 API calls (e.g., `InitOnceExecuteOnce`, `TimerQueue` callbacks) instead of `CreateThread` to bypass EDR detection.
- Use of the undocumented ntdll routine `EtwpCreateEtwThread` for thread creation.
- Payload obfuscation using XOR with rolling keys and byte reversal.
- **Reconnaissance:**
- Use of **Nuclei** scanner with critical-severity templates against target URL lists.
- **Exploitation of Vulnerabilities:**
- CVE-2018-11511 (ASUSTOR ADM)
- CVE-2021-24139 (10Web Photo Gallery WordPress plugin)
- CVE-2021-31755 (Tenda AC11 routers)
- CVE-2021-32305 (WebSVN)
## Targeting
- **Sectors:** Government, Healthcare, Education.
- **Geography:** Asia (Vietnam, Malaysia, Hong Kong) and Latin America (Honduras).
- **Victims:**
- Vietnam: Public hospital (medical imaging system).
- Malaysia: Ministry of Foreign Affairs.
- Hong Kong: Education infrastructure (14,653 URLs scanned).
- Honduras: National Congress (targeted via spear-phishing).
## Tools & Infrastructure
- **Malware Families:**
- **TriBack Loader:** A previously undocumented Windows loader found in four variants.
- **Beagle Backdoor:** Also known as "Donuts and Beagles."
- **DonutLoader:** Used to execute the Beagle backdoor.
- **Post-Exploitation Frameworks:**
- **AdaptixC2:** An open-source post-exploitation framework.
- **Infrastructure:**
- **Alibaba Cloud:** Singapore region (used for operation management).
- claude-pro[.]com (Malicious domain registered March 2026).
- license[.]claude-pro[.]com (C2 for Beagle backdoor).
## Implications
JadeProx demonstrates the continued trend of Chinese-nexus actors leveraging open-source frameworks (AdaptixC2) and undocumented Windows APIs to evade modern EDR solutions. The targeting of public health and foreign affairs indicates a strategic interest in sensitive regional data and political intelligence. Their use of "N-day" vulnerabilities (some over 5 years old) highlights a focus on exploiting unpatched legacy infrastructure in target regions.
## Mitigations
- **Binary Monitoring:** Flag signed vendor binaries running from unusual locations such as user-writable directories (`AppData`), `Temp`, or `Startup` folders.
- **Heuristic Detection:** Hunt for instances where a signed executable is co-located with an encrypted or high-entropy `.dat` or `.log` file in the same directory.
- **Vulnerability Management:** Prioritize patching of edge devices and plugins, specifically CISA KEV-listed bugs like CVE-2021-31755.
- **Endpoint Security:** Monitor for suspicious API calls from legitimate binaries, focusing on `InitOnceExecuteOnce` and `EtwpCreateEtwThread`.
- **Web Defense:** Block access to known impersonation domains (e.g., claude-pro[.]com).