A China-nexus operation that Group-IB tracks as JadeProx has been running active intrusions against government, healthcare, and education organizations across Asia and Latin America, using a previously undocumented Windows loader the researchers call TriBack Loader. The group surfaced after an exposed Alibaba Cloud server in the Singapore region gave researchers a direct look at the operation's tooling, phishing packages, and post-exploitation activity.

The server's contents pointed to confirmed intrusions against a Vietnamese public hospital's medical imaging system and Malaysia's Ministry of Foreign Affairs, plus scanning and exploitation follow-up against Hong Kong education infrastructure and a spear-phishing package addressed to the National Congress of Honduras. At the hospital, the operators gained access through webshells planted on an exposed Java management interface.

If you run internet-facing systems in these sectors, the practical risk is twofold. Access to a hospital imaging server or a foreign ministry's network exposes sensitive patient records and diplomatic communications, and it opens the door to operational disruption of clinical or government systems that are difficult to take offline for recovery.

TriBack Loader itself is the engineered half of the operation. It appears in four infection chains built around DLL sideloading, pairing a legitimate signed executable with a malicious DLL and an encrypted payload. Across the recovered builds, the loader carried several distinct payloads:

• AdaptixC2, an open-source post-exploitation framework, delivered by two variants.
• Beagle, a backdoor first documented by Sophos, run through DonutLoader in a Claude-themed variant.
• A fourth variant whose payload was never recovered.

Alongside the loader work, the operators ran the Nuclei scanner against Hong Kong education targets and attempted four CVEs against individual hosts: CVE-2018-11511 in ASUSTOR ADM, CVE-2021-24139 in the 10Web Photo Gallery WordPress plugin, CVE-2021-31755 in Tenda AC11 routers, and CVE-2021-32305 in WebSVN. Each carries a CVSS base score of 9.8. The scanning half of this operation ran entirely on flaws disclosed in 2018 and 2021, with the custom loader engineering reserved for what happens after the break-in.

Attack Chain: From Vulnerability Exploitation to Command-and-Control

The scanning half of this operation runs on old flaws. Group-IB found the operators using Nuclei, an open-source vulnerability scanner, loaded with critical-severity templates only, against a list of 14,653 Hong Kong education-related URLs. That scan surfaced 13 unique vulnerabilities. The report frames those 14,653 URLs as a target list and does not say how many follow-up attempts landed.

Against individual hosts, the operators attempted four specific CVEs, all confirmed against NVD on July 23, 2026 and each carrying a CVSS base score of 9.8:

• CVE-2018-11511 in ASUSTOR ADM (network-attached storage firmware)
• CVE-2021-24139 in the 10Web Photo Gallery WordPress plugin
• CVE-2021-31755 in Tenda AC11 routers
• CVE-2021-32305 in WebSVN (a web-based Subversion repository viewer)

The Tenda bug has sat on CISA's Known Exploited Vulnerabilities catalog since November 3, 2021, with a federal remediation deadline that expired two weeks later. For a defender, the takeaway is that initial access here does not require a novel exploit — it requires an internet-facing system left unpatched for years.

Once inside, the operation shifts to the custom tooling. TriBack Loader is built around DLL sideloading: a legitimate signed executable is paired with a malicious DLL and an encrypted .dat or .log payload sitting in the same folder. The DLL reverses the payload bytes, XORs them with a rolling key, and runs the resulting shellcode.

The evasion detail matters. Rather than executing through CreateThread, which EDR watches closely, the builds rotate less-monitored Win32 execution calls — InitOnceExecuteOnce, a TimerQueue callback, and in a third variant EtwpCreateEtwThread, an undocumented thread-creation routine in ntdll. That repeated API sequence across builds is why Group-IB believes a custom loader builder is generating these chains. For your business, this means endpoint tools tuned to catch standard thread-creation calls may miss the execution step entirely.

Payload delivery and persistence come together in the Claude-themed campaign. A malicious MSI installer, served from the fake claude-pro[.]com site registered March 28, 2026, asks for a UAC prompt, then drops the sideloading chain into the Windows Startup folder. That placement gives the operators persistence across reboots. This variant used DonutLoader to run Beagle, a backdoor Sophos first documented, and Beagle reported to license[.]claude-pro[.]com.

Two other variants delivered AdaptixC2, an open-source post-exploitation framework, as the command-and-control layer. AdaptixC2 is what turns a foothold into a hands-on-keyboard intrusion: remote command execution, file transfer, and follow-on tooling. The fourth variant's payload was never recovered, because its encrypted companion file was missing from the exposed server.

The confirmed staging server was 43.106.71[.]28 on port 8000. Group-IB's July 23 report lists additional cluster domains to block or investigate:

• claude-pro[.]com and license[.]claude-pro[.]com
• sylverixstrategy[.]com, gouvvbo[.]top, vertextrust-advisors[.]com
• Three security-vendor lookalikes sharing one IP: update-trellix[.]com, update-crowdstrike[.]com, and update-sentinelone[.]com

File-level artifacts tie the chain together: unexpected copies of hostfxr.dll, avk.dll, or MpClient.dll, nested _CL_###### folders, and ~del.vbs.bat. Sophos found the same reused XOR key in builds going back to February but declined to attribute the activity to one actor on that basis alone. The full progression — decade-old flaw to signed-binary sideload to AdaptixC2 — gives defenders a detection window at each handoff.

Operational and Compliance Risk for Government, Healthcare, and Education

The most consequential intrusion in this cluster hit a Vietnamese public hospital's medical imaging system, reached through webshells planted on an exposed Java management interface. If your organization runs a similar imaging or PACS environment, an attacker sitting on that server has access to diagnostic images and the patient identifiers attached to them.

For a healthcare provider, that exposure is not just a security event. Patient imaging tied to names, dates of birth, and medical record numbers is protected health information. Under HIPAA, a confirmed breach of that data triggers formal notification duties: you notify affected patients, report to the Department of Health and Human Services, and, above a certain threshold, notify the media in the affected area.

Those obligations carry real cost. You absorb notification logistics, credit monitoring for patients, forensic investigation, and potential civil penalties from regulators. An imaging system offline during response also means delayed diagnoses and rescheduled procedures, which is clinical disruption on top of the compliance bill.

Government targets in this operation include Malaysia's Ministry of Foreign Affairs and a spear-phishing package addressed to the National Congress of Honduras. When you run a foreign affairs or legislative body, the loss here is diplomatic correspondence, internal policy documents, and the credentials that unlock adjacent government systems.

Because the operators use signed vendor binaries and post-exploitation frameworks that blend into normal activity, they can sit inside a network reading traffic without tripping standard alerts. For a government agency, that means an adversary reads your negotiating positions and internal deliberations while you continue operating as if the channel is private. U.S. federal agencies operating cloud workloads under FedRAMP would face authorization and continuous-monitoring consequences from an intrusion of this kind, on top of the intelligence loss.

Education institutions saw the broadest reconnaissance. The operators ran a scanner against a large list of Hong Kong education-related URLs looking for exploitable hosts.

If you administer a university or school system, that scanning targets the same web-facing infrastructure that holds student records, enrollment data, and research. A compromise there exposes education records covered by FERPA in the United States, and it puts unpublished research and grant data at risk. Universities also tend to run large, decentralized IT estates, which means one unpatched public-facing host can be the entry point while dozens of other systems stay unmonitored.

Across all three sectors, the shared consequence is time. Detecting a loader that hides shellcode behind legitimate signed executables takes longer than catching commodity malware, and a longer dwell time means more data read, more systems reached, and a larger notification population when you finally scope the incident.

The operators reached a public hospital's imaging server through webshells on an exposed Java management interface — the entry point was an internet-facing application, not a sophisticated zero-day.

The pattern to take from these victims: the initial break-in came through public-facing systems that were reachable and, in the education case, scanned for known flaws. The sector determines what you lose once they are inside, but the exposure that let them in was the same across government, healthcare, and education.

Detection and Immediate Response Actions

The fastest signal available to you today sits in your web server access logs. The JadeProx operators fed Nuclei critical-severity templates against public hosts, so grep those logs for the request paths tied to the four CVEs the operators attempted: CVE-2018-11511 (ASUSTOR ADM), CVE-2021-24139 (10Web Photo Gallery), CVE-2021-31755 (Tenda AC11), and CVE-2021-32305 (WebSVN). Repeated probes from a single source against these endpoints indicate reconnaissance against your perimeter.

Next, hunt the endpoints for the TriBack Loader sideloading chain. Because the operators rotate filenames and signed host binaries per build, the file layout is your most reliable indicator, not any single hash.

• Search for signed vendor executables running from user-writable, temporary, or Startup directories, with an encrypted .dat or .log file sitting in the same folder.
• Flag unexpected copies of hostfxr.dll, avk.dll, or MpClient.dll outside their normal install paths.
• Look for nested _CL_###### folders and the ~del.vbs.bat artifact.

Watch process telemetry for the loader's thread-creation behavior. The builds route final shellcode execution through InitOnceExecuteOnce, a TimerQueue callback, or EtwpCreateEtwThread in ntdll rather than the usual CreateThread, precisely because those calls draw less scrutiny. In environments Capstone manages, SentinelOne flags this signed-binary-plus-encrypted-payload execution pattern and the anomalous thread creation at the endpoint, before the DonutLoader stage hands off to a backdoor.

Block the cluster's infrastructure at your firewall and DNS resolver this week. Add these domains to your blocklist and alert on any historical resolution:

• claude-pro[.]com and license[.]claude-pro[.]com
• sylverixstrategy[.]com, gouvvbo[.]top, and vertextrust-advisors[.]com
• The three security-vendor lookalikes sharing one IP: update-trellix[.]com, update-crowdstrike[.]com, and update-sentinelone[.]com
• The staging server 43.106.71[.]28 on port 8000

Patch those four CVEs on any exposed system this week; each carries a CVSS base score of 9.8, and the Tenda bug has sat on CISA's Known Exploited Vulnerabilities catalog since November 3, 2021. If your DNS logs show past resolution of any listed domain, treat the associated host as potentially compromised and pull its command history — the operators used an open-source post-exploitation framework, so review shell and beacon activity for lateral movement and credential access.

For longer-term containment, application allowlisting stops unsigned or misplaced DLLs from loading alongside trusted executables, which directly counters the sideloading technique. Segment critical systems — imaging servers, foreign-affairs infrastructure, and other high-value hosts — so a webshell on an exposed Java interface cannot reach them laterally. Keep EDR tuned for the behavioral markers above rather than static hashes, because the loader builder rotates its file artifacts between campaigns.

The scanning half of this operation ran on flaws disclosed in 2018 and 2021, and every one of them has a vendor fix available. Closing those four gaps removes the initial access path that the custom loader engineering depends on.

Prioritizing Patches and Vulnerability Remediation

Start with the one flaw that is both under active exploitation and government-tracked: CVE-2021-31755, the stack overflow in Tenda AC11 routers. It sits on CISA's Known Exploited Vulnerabilities catalog, added November 3, 2021, with a federal remediation deadline that lapsed two weeks later. That listing tells you this bug has confirmed exploitation history beyond JadeProx, and any Tenda AC11 device still exposed to the internet in your environment needs to come off the perimeter or get its firmware updated within the first 48 hours.

All four CVEs the operators attempted carry a CVSS base score of 9.8, so severity alone does not separate them. What separates them is exposure and exploitation evidence. Triage by where the vulnerable product actually lives and whether it faces the internet.

Group-IB's own ordering is explicit: put internet-facing Java applications first, then any public-facing system carrying one of these unpatched 9.8-rated flaws. Use that as your queue logic.

• First 48 hours: CVE-2021-31755 in Tenda AC11 routers. It is on the KEV catalog with an expired federal deadline, meaning active exploitation is confirmed and remediation is already overdue by government standard.
• First 48 hours if internet-facing: CVE-2021-32305 in WebSVN, a web-based Subversion repository browser. WebSVN is a public-facing web application by design, and the operators fed critical-severity scan templates against public hosts, so an exposed instance is a direct target.
• Within two weeks: CVE-2021-24139 in the 10Web Photo Gallery WordPress plugin. This matters only if you run WordPress with that plugin installed. Confirm the plugin is present before you treat it as urgent; a site without it carries no risk from this CVE.
• Within two weeks, lower urgency: CVE-2018-11511 in ASUSTOR ADM, the operating system on ASUSTOR network-attached storage. Patch it if the NAS management interface is reachable from outside; if it sits on an internal segment only, it drops down your queue.

The practical filter here is asset inventory. You cannot patch a Tenda router, a WebSVN install, or an ASUSTOR NAS you do not know you own. Run a discovery pass against your external attack surface first, match results to these four products, and only then decide what is genuinely exposed versus theoretically vulnerable.

Note the disclosure ages. Three of these flaws date to 2021 and one to 2018. If your patch cadence is current, several of these may already be closed on managed hardware, and the exercise becomes confirmation rather than emergency remediation.

The custom work all sits downstream of the break-in.

That is the strategic point for your patch queue. The initial access these operators used did not require anything novel. Closing an internet-facing 9.8-rated flaw from four or five years ago removes the entry path before the sideloading chain and post-exploitation tooling ever load.

On the identity side, once a public-facing exploit lands, the operators move to credential use and lateral access. Adlumin monitors authentication patterns across managed environments, surfacing login anomalies that follow a perimeter compromise before an attacker pivots to internal systems. Pair that monitoring with the patch work above so that a missed host does not go unnoticed after exploitation.

Confirm remediation against the vendor advisory for each affected product rather than assuming a version number, and re-scan the same external hosts after patching to verify the vulnerable endpoints no longer respond.

Key Takeaway: Patch These Four CVEs and Monitor for TriBack Loader Execution

The scanning half of the JadeProx operation runs entirely on flaws disclosed in 2018 and 2021, which means your exposure is measurable today. CVE-2018-11511, CVE-2021-24139, CVE-2021-31755, and CVE-2021-32305 each carry a CVSS base score of 9.8, and Group-IB confirmed the operators attempted all four against individual hosts. If your government, healthcare, or education environment runs ASUSTOR ADM storage, the 10Web Photo Gallery WordPress plugin, Tenda AC11 routers, or WebSVN, you are working from known, patchable ground.

Assess exposure to these four CVEs first, then apply the fixed versions from each vendor's advisory. These are not zero-days requiring novel defense; they are years-old bugs with published fixes that many organizations never applied.

The second priority is watching for execution of the malware that follows the break-in. Group-IB tied the TriBack Loader sideloading chain to delivery of Beagle and AdaptixC2, the two post-exploitation tools recovered from the exposed staging server. Alerting on their process behavior and command-and-control callbacks gives you a signal for intrusions that already cleared the perimeter.

The consequence of leaving these gaps open depends on your sector. For the Vietnamese hospital's imaging environment, the exposure reached patient diagnostic data. For a government ministry, it reached diplomatic communications and internal systems. In each case, the initial foothold came through a known flaw that patching would have closed.