# China-Nexus JadeProx Targets Hospitals and Ministries with Stealthy TriBack Loader — and a Fake Claude Site
## The Threat
An exposed Alibaba Cloud server in Singapore handed researchers at Group-IB an unusually complete window into a China-nexus intrusion operation they now track as JadeProx. The server, discovered in mid-April 2026 and offline by the time the report published July 23, contained bash history, phishing packages, post-exploitation tooling, and webshell paths that mapped out active intrusions against real targets: a Vietnamese public hospital's medical imaging system, Malaysia's Ministry of Foreign Affairs, Hong Kong education infrastructure, and a spear-phishing package addressed to Honduras's National Congress.
The new capability at the center of the operation is a previously undocumented Windows loader Group-IB calls TriBack Loader. It arrives via DLL sideloading — a technique that pairs a legitimate, signed binary with a malicious DLL and an encrypted payload file — and it cycles through execution methods that are deliberately chosen to avoid scrutiny. Rather than calling CreateThread, which modern EDR products watch aggressively, TriBack's DLL reverses the payload bytes, XOR-decrypts them with a rolling key, and executes the resulting shellcode through one of three alternate Win32 routines: InitOnceExecuteOnce, a TimerQueue callback, or EtwpCreateEtwThread, an undocumented thread-creation path buried in ntdll. The rotation across builds, combined with a changing host binary each time, points to a custom builder generating variants on demand.
The payloads delivered through this chain include AdaptixC2, an open-source post-exploitation framework, and Beagle, a backdoor Sophos first documented. A fourth variant's payload was never recovered — its encrypted companion file remains unknown. On the social engineering side, one phishing archive used a fake beverage company account statement as a decoy. Another campaign impersonated Anthropic's Claude AI software using the domain claude-pro[.]com, registered March 28, 2026, which served a malicious MSI installer that, past a UAC prompt, dropped the sideloading chain into the Windows Startup folder for persistence. The Beagle backdoor installed by that campaign reported back to license[.]claude-pro[.]com.
## Severity and Impact
The four CVEs Group-IB documented in JadeProx's scanning and exploitation activity are all critical-severity, unpatched or long-overdue vulnerabilities in widely deployed products.
| CVE | Product | CVSS Score | Attack Vector | Attack Complexity | Auth Required | Notes |
|-----|---------|-----------|---------------|-------------------|---------------|-------|
| CVE-2018-11511 | ASUSTOR ADM | 9.8 | Network | Low | None | 8-year-old vulnerability |
| CVE-2021-24139 | 10Web Photo Gallery (WordPress plugin) | 9.8 | Network | Low | None | Plugin-level RCE |
| CVE-2021-31755 | Tenda AC11 Router | 9.8 | Network | Low | None | CISA KEV since Nov 2021 |
| CVE-2021-32305 | WebSVN | 9.8 | Network | Low | None | Source control exposure |
The Tenda router vulnerability has been on CISA's Known Exploited Vulnerabilities catalog since November 3, 2021. The federal remediation deadline expired two weeks after it was added. It is still being used in active operations five years later.
## Affected Products and Targeted Sectors
Direct Intrusion Targets (confirmed active):
Exploitation Surface (vulnerable product categories):
Potential Broad Exposure via Malvertising:
## Mitigations
Immediate actions:
InitOnceExecuteOnce and EtwpCreateEtwThread executing shellcode will catch variants that evade signature detection.Longer-term posture:
## References
---
## HackWire Analysis
The most underreported angle in this story is the medical imaging system. Hospitals run imaging infrastructure — PACS servers, DICOM gateways, radiology workstations — on software stacks that are years behind the rest of enterprise IT. Java management interfaces get exposed because the vendor never intended them to face the internet, and nobody mapped the attack surface when the system was installed. JadeProx didn't need a zero-day to reach that hospital: they found an exposed interface and planted a webshell. That is a solved problem in 2026, and yet here we are.
The fake Claude installer is a different kind of signal. China-nexus operators impersonating a major AI brand with a fresh domain and an MSI installer is not random. It reflects that threat actors are tracking the software employees are searching for right now. Claude adoption is accelerating in professional and government environments; the malvertising hypothesis means this campaign may have cast a far wider net than the named institutional targets suggest. If Sophos is right, the real victim count is unknown.
Group-IB's deliberate restraint in attribution is worth noting. They group the builds with the Asian intrusions based on the server's contents — not just tool overlap — but explicitly stop short of linking JadeProx to a named established group. That is the right call. Tooling circulates freely across China-nexus clusters, and a shared XOR key or a common framework is not operator identity. The refusal to over-attribute is increasingly rare and should be the industry standard.
The four CVEs being actively exploited in 2026 are the quiet indictment in this report. None are new. One has been on the CISA KEV for five years. Sophisticated loaders and novel execution techniques matter less if defenders can't clear the backlog of unpatched 9.8s on their network perimeter.
— HackWire Editorial
## Related Coverage