14,653 — the number of Hong Kong education-related URLs swept by automated scanning in an operation tied to a China-nexus cluster that Group-IB traces as JadeProx, and the first public clue to a previously undocumented Windows loader the researchers call TriBack Loader.
Exposed Alibaba Cloud server lays out a multi‑target operation
Group-IB discovered an exposed server in Alibaba Cloud's Singapore region in mid‑April 2026; the server was offline by the time Group-IB published its report on July 23, 2026. Its bash history, phishing packages, post‑exploitation tools, and webshell paths documented active intrusions against a Vietnamese public hospital's medical imaging system and Malaysia's Ministry of Foreign Affairs, scanning and exploitation follow‑up against Hong Kong education infrastructure, and a spear‑phishing package addressed to the National Congress of Honduras.
According to Group-IB, operators reached the hospital's imaging server through webshells planted on an exposed Java management interface. Group-IB stops short of assigning the activity to a named, established group, observing that "tooling moves freely in the China‑nexus ecosystem," so a tooling match is not a direct operator match.
TriBack Loader: four builds, DLL sideloading, and an evasive execution chain
TriBack Loader appears in four infection chains built around DLL sideloading. Most recovered builds pair a legitimately signed executable with a malicious DLL and an encrypted .dat or .log payload. Group‑IB's analysis shows the DLL "reverses the payload bytes, XORs them with a rolling key, and executes the shellcode through Win32 calls that EDR watches less closely than CreateThread."
The builds rotate the final call: two variants use InitOnceExecuteOnce and a TimerQueue callback respectively, while a third uses EtwpCreateEtwThread, described in the report as an undocumented thread‑creation routine in ntdll. The signed host binary changed between variants as well; Group‑IB interprets the repeated API sequence as evidence of a custom loader builder.
Payloads recovered include AdaptixC2, an open‑source post‑exploitation framework, and, in a Claude‑themed variant, a DonutLoader‑launched Beagle backdoor — the latter first documented by Sophos. One variant's payload remains unknown: Group‑IB recovered an encrypted companion file for it but not the decrypted payload.
Distribution: fake Claude site, spear‑phishing decoys, and malvertising signals
Operators used spear‑phishing archives with decoys such as fake beverage‑company account statements. A more public distribution vector impersonated Anthropic's Claude via claude‑pro[.]com, a domain registered March 28, 2026, which served a malicious MSI installer that, once a UAC prompt was accepted, placed the sideloading chain into the Windows Startup folder for persistence. The Beagle backdoor reported to license[.]claude‑pro[.]com.
Sophos, working from the fake site, its hosting infrastructure, and malware samples, found the same reused XOR key in builds going back to February, though Sophos warned a shared key alone is insufficient to conclude a single actor. Sophos also assessed that the fake Claude site was likely part of an active malvertising campaign, a distribution vector that could reach users searching for a Claude download beyond the named ministries and hospitals.
Scanning, exploited CVEs, and a long tail of old flaws
The operation's scanning work leaned on vulnerabilities disclosed in 2018 and 2021. Group‑IB ran Nuclei with critical‑severity templates only against a scan list of 14,653 Hong Kong education‑related URLs and surfaced 13 unique vulnerabilities; the report does not say how many follow‑ups succeeded.
Group‑IB named four CVEs the operators attempted against individual hosts; The Hacker News confirmed all four against NVD on July 23, 2026: CVE‑2018‑11511 in ASUSTOR ADM, CVE‑2021‑24139 in the 10Web Photo Gallery WordPress plugin, CVE‑2021‑31755 in Tenda AC11 routers, and CVE‑2021‑32305 in WebSVN. Each carries a CVSS base score of 9.8. The Tenda vulnerability has been on CISA's Known Exploited Vulnerabilities catalog since November 3, 2021, with a federal remediation deadline that expired two weeks later.
What this means for government, healthcare, and education
- Government: Ministries with public‑facing services should prioritize internet‑facing Java applications and any host exposing an unpatched 9.8‑rated flaw, the report recommends; Malaysia's Ministry of Foreign Affairs was among the intrusions documented on the exposed server.
- Healthcare: The Vietnamese public hospital intrusion shows medical imaging systems can be reached through exposed management interfaces and post‑exploit webshells; hospital IT teams should treat exposed Java management interfaces as high‑risk.
- Education: Operators scanned 14,653 Hong Kong education URLs and surfaced 13 unique vulnerabilities; education technology teams should treat scan lists as indicators of focused follow‑up activity rather than one‑off probes.
Group‑IB and Sophos provide concrete detection and mitigation cues: flag signed vendor binaries executing from user‑writable, temporary, or Startup directories when an encrypted .dat/.log shares the folder; look for unexpected hostfxr.dll, avk.dll, or MpClient.dll copies, nested _CL_###### folders, and ~del.vbs.bat; and block or investigate identified domains and the staging server (43.106.71[.]28:8000). The domains called out by Group‑IB include claude‑pro[.]com, license[.]claude‑pro[.]com, sylverixstrategy[.]com, gouvvbo[.]top, vertextrust‑advisors[.]com and three security‑vendor lookalikes sharing one IP: update‑trellix[.]com, update‑crowdstrike[.]com, and update‑sentinelone[.]com.
The exposed server left a clear chain from scanning and phishing to bespoke loader engineering and focused intrusions. The immediate trace indicators — domains, IP, filenames, DLL names, and the unique loader behaviors using InitOnceExecuteOnce, TimerQueue callbacks, or EtwpCreateEtwThread — give defenders concrete signatures to hunt. Whether those signatures map to a single operator or a toolset circulated through a China‑nexus ecosystem, Group‑IB's record ties those signatures to active compromises in government, healthcare, and education systems.
