JadeProx Espionage Campaign Exposed After Operator OPSEC Failure
In April 2026, a critical oversight by cyber espionage operators inadvertently revealed a far-reaching campaign tracked as JadeProx, targeting institutions across Southeast Asia and Latin America. The breach occurred when attackers left an Alibaba Cloud staging server exposed, exposing tools, command logs, and phishing kits in plain view.
The campaign leveraged a newly identified TriBack Loader, deployed via DLL sideloading to evade detection. By abusing legitimate Windows callback functions, the malware bypassed security tools, decrypting and executing shellcode with minimal visibility. Two variants delivered AdaptixC2 beacons, while a third deployed the Beagle backdoor.
Targets and Tactics
Victims included:
- A Vietnamese public hospital’s medical imaging system
- The Malaysian Ministry of Foreign Affairs
- Hong Kong education sites
- Honduras’ National Congress, lured via a fake beverage company statement
Attackers used fake Claude software themes and spoofed portals such as a Venezuelan municipal tax system to steal credentials. In Honduras, a phishing archive (Estado de Cuenta.zip) delivered malware via a signed Microsoft binary, while Claude-themed packages abused trusted vendor programs.
Infrastructure and Attribution
The exposed server contained:
- Bash history logs showing access to victim networks
- SOCKS tunnels, network scanners, and port forwarders
- Scripts to evade cloud monitoring
Researchers from Group-IB linked the campaign to China-nexus espionage patterns, noting shared tools and infrastructure with prior APT activity. The TriBack Loader evolved across four builds in two months, swapping host binaries while maintaining a consistent evasion technique.
Indicators of Compromise (IoCs)
Key infrastructure included:
- IPs:
43.106.71[.]28(staging server),8.217.190[.]58(C2) - Domains:
license[.]claude-pro[.]com,sylverixstrategy[.]com,gouvvbo[.]top - Malicious files:
Estado de Cuenta.zip,hostfxr.dll,Claude.msi
The breach underscores the risks of DLL sideloading and the persistence of AdaptixC2 in espionage operations. Defenders are advised to monitor for nested folders (e.g., _CL*), signed binaries launching from writable paths, and unusual callback activity.
Source: https://cybersecuritynews.com/opsec-mistake-exposed-triback-malware/
Hong Kong Shue Yan University cybersecurity rating report: https://www.rankiteo.com/company/hong-kong-shue-yan-university
Hoan My Medical Corporation cybersecurity rating report: https://www.rankiteo.com/company/hoan-my-medical-corporation
Ministry of Foreign Affairs, Malaysia cybersecurity rating report: https://www.rankiteo.com/company/ministry-of-foreign-affairs-malaysia
"id": "HONHOAMIN1784823871",
"linkid": "hong-kong-shue-yan-university, hoan-my-medical-corporation, ministry-of-foreign-affairs-malaysia",
"type": "Cyber Attack",
"date": "4/2026",
"severity": "100",
"impact": "8",
"explanation": "Attack that could bring to a war"{'affected_entities': [{'industry': 'Healthcare',
'location': 'Vietnam',
'name': 'Vietnamese public hospital',
'type': 'Healthcare'},
{'industry': 'Government',
'location': 'Malaysia',
'name': 'Malaysian Ministry of Foreign Affairs',
'type': 'Government'},
{'industry': 'Education',
'location': 'Hong Kong',
'name': 'Hong Kong education sites',
'type': 'Education'},
{'industry': 'Government',
'location': 'Honduras',
'name': 'Honduras’ National Congress',
'type': 'Government'}],
'attack_vector': ['Phishing', 'DLL Sideloading'],
'data_breach': {'data_exfiltration': 'Likely (based on espionage motivation)',
'file_types_exposed': ['ZIP', 'DLL', 'MSI'],
'personally_identifiable_information': 'Likely',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Credentials',
'Sensitive institutional data']},
'date_detected': '2026-04',
'description': 'In April 2026, a critical oversight by cyber espionage '
'operators inadvertently revealed a far-reaching campaign '
'tracked as JadeProx, targeting institutions across Southeast '
'Asia and Latin America. The breach occurred when attackers '
'left an Alibaba Cloud staging server exposed, exposing tools, '
'command logs, and phishing kits in plain view. The campaign '
'leveraged a newly identified TriBack Loader, deployed via DLL '
'sideloading to evade detection. By abusing legitimate Windows '
'callback functions, the malware bypassed security tools, '
'decrypting and executing shellcode with minimal visibility. '
'Two variants delivered AdaptixC2 beacons, while a third '
'deployed the Beagle backdoor.',
'impact': {'data_compromised': 'Credentials, sensitive institutional data',
'identity_theft_risk': 'High (PII exposure)',
'operational_impact': 'Potential disruption of government and '
'healthcare services',
'systems_affected': ['Medical imaging systems',
'Government networks',
'Education sites']},
'initial_access_broker': {'backdoors_established': 'AdaptixC2 beacons, Beagle '
'backdoor',
'entry_point': ['Phishing (e.g., Estado de '
'Cuenta.zip)',
'Fake software themes (Claude.msi)'],
'high_value_targets': ['Government agencies',
'Healthcare institutions',
'Education sites']},
'investigation_status': 'Ongoing',
'lessons_learned': 'The breach underscores the risks of DLL sideloading and '
'the persistence of AdaptixC2 in espionage operations. '
'Defenders should monitor for nested folders (e.g., _CL*), '
'signed binaries launching from writable paths, and '
'unusual callback activity.',
'motivation': 'Espionage',
'post_incident_analysis': {'corrective_actions': 'Enhanced monitoring, '
'detection of DLL '
'sideloading, and secure '
'cloud configurations',
'root_causes': 'Operator OPSEC failure (exposed '
'Alibaba Cloud server), abuse of '
'legitimate Windows callback '
'functions for evasion'},
'recommendations': ['Monitor for nested folders (e.g., _CL*)',
'Detect signed binaries launching from writable paths',
'Watch for unusual callback activity',
'Enhance monitoring for DLL sideloading techniques'],
'references': [{'source': 'Group-IB'}],
'response': {'enhanced_monitoring': 'Recommended',
'third_party_assistance': 'Group-IB'},
'threat_actor': 'China-nexus espionage group',
'title': 'JadeProx Espionage Campaign Exposed After Operator OPSEC Failure',
'type': 'Cyber Espionage',
'vulnerability_exploited': 'DLL Sideloading via legitimate Windows callback '
'functions'}