An exposed directory on an operator-controlled Alibaba Cloud server revealed the inner workings of the JadeProx intrusion set, including bash history, webshell paths, phishing kits, and a full post-exploitation toolkit.
From this single staging host, investigators traced concurrent operations targeting a Vietnamese public hospital’s medical imaging system, the Malaysian Ministry of Foreign Affairs, multiple Hong Kong educational institutions, and government entities in Honduras and Venezuela.
The open directory showed heavy use of Chinese-origin offensive tooling: iox and Neo-reGeorg for tunneling, suo5 for SOCKS5-over-HTTP pivoting via webshells, nuclei and fscan for mass vulnerability scanning and internal reconnaissance, and a modified fuckaliyun.sh script designed to disable Alibaba Cloud’s security monitoring agents.
Additional binaries, including a custom SOCKS5 proxy and XMRig proxy, suggest the same infrastructure is used both for intrusion operations and monetization or cover traffic.
JadeProx TriBack Campaign
At the center of the campaigns is TriBack Loader, a three-file triad that abuses DLL sideloading of signed binaries to decrypt and execute shellcode payloads in memory using Win32 callback APIs rather than typical thread creation routines.
Across four identified variants, the operators rotate host binaries (e.g., Microsoft Service Hub, G DATA avk.exe, Microsoft MpClient utilities) while preserving a consistent two-stage decryption pattern based on byte reversal and rolling XOR with per-build keys.
Two variants ultimately load AdaptixC2, an open-source beacon framework, with decrypted configurations revealing HTTP C2 profiles, sleep intervals, and in one case a GitHub analytics cookie linking activity to previously documented Chinese APT tooling.
Another variant leverages a Claude-Pro themed phishing lure to deliver a Donut-based shellcode loader that runs Beagle, a backdoor previously reported in connection with fake Claude portals.
A fourth variant, seen in a DeviceSync package using a Microsoft malware protection binary, follows the same loader logic but hides its final payload in an unavailable .log file, indicating a common builder that can generate multiple triads around different signed hosts.
TriBack’s use of rarely monitored APIs such as InitOnceExecuteOnce, TimerQueue callbacks, and EtwpCreateEtwThread further reduces detection opportunities for EDR solutions that focus on conventional CreateThread plus VirtualAlloc execution chains.
JadeProx victimology spans Vietnam, Malaysia, Hong Kong, Honduras, Venezuela, and likely other regions where governments and education networks are exposed via unpatched web and network appliances.
In Hong Kong, a targets list of over 14,000 education-sector URLs was scanned with nuclei using only critical-severity templates, leading to exploitation of CVSS 9.8 vulnerabilities in ASUSTOR ADM and WordPress Photo Gallery plugins, as well as high-impact bugs in Tenda routers and WebSVN installations, group-ib said.
The same infrastructure also hosts convincing phishing portals. One domain impersonates the municipal tax system for the Venezuelan Municipality Piar, collecting identity documents and payment records while doubling as a C2 endpoint for AdaptixC2 beacons.
Another front site, “Vertex Trust Advisors,” mimics a Singapore-based financial services brand to provide cover for Claude-Pro themed malware distribution, making backend domains appear more legitimate to reputation systems.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
