JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake
Essential information
- Published
- 23/07/2026 13:57
- Modified
- —
- Source / Author
- AlienVault
- Confidence
- 100/100
- Report type(s)
- threat-report
- Labels / Tags
- adaptixc2 beagle beagle backdoor china-nexus cve-2018-11511 cve-2021-24139 cve-2021-31755 cve-2021-32305 dll sideloading jadeprox phishing plugx southeast asia targeting triback loader xmrig
- Related entities
- 4 vulnerabilities (cve), 17 indicators, 11 observables, 1 intrusion sets (apt), 15 techniques (mitre), 6 malware
Description
In mid-April 2026, an exposed directory on an Alibaba Cloud server revealed a comprehensive China-nexus operation targeting government, healthcare, and education sectors across Southeast Asia and Latin America. The investigation uncovered simultaneous intrusions against Vietnamese hospitals, the Malaysian Ministry of Foreign Affairs, Hong Kong educational institutions, and targets in Honduras and Venezuela. At the center is TriBack Loader, a custom malware family using DLL sideloading with signed binaries and Win32 callback APIs to deliver AdaptixC2 and Beagle backdoors. The exposed server contained post-exploitation toolkits, bash history, and victim paths, revealing ongoing operations. Infrastructure analysis showed consistent use of NameSilo registrations, Alibaba hosting, and Cloudflare fronting. Phishing campaigns included fake portals impersonating Venezuelan tax systems and Claude-Pro software. The operation demonstrates shared tooling common across Chinese APT groups, with TTPs overlapping multiple...