Modus Operandi: JADEPROX

Anatomy of a China-Nexus Espionage Operation

BOTTOM LINE

A basic operational-security failure exposed an unusually detailed view of a sophisticated China-nexus intrusion operation targeting government, healthcare, education, and public-sector organizations across Southeast Asia and Latin America.

In mid-April 2026, Group-IB researchers discovered an operator-controlled Alibaba Cloud server running a Python HTTP service on port 8000 with directory listing enabled. The exposed server contained bash command history, victim information, webshell locations, phishing packages, tunneling utilities, vulnerability-scanning results, post-exploitation tools, and multiple versions of a previously undocumented shellcode loader.

Group-IB now tracks the activity cluster as JadeProx and the associated loader as TriBack Loader. The infrastructure was no longer active when Group-IB published its findings on July 23, 2026.

The evidence indicates that JadeProx is not simply a mass-scanning operation. Its operators combine large-scale vulnerability discovery with selective exploitation, hands-on keyboard activity, customized phishing lures, webshell-based access, covert tunneling, DLL sideloading, and adaptable command-and-control frameworks.

The most important intelligence judgment is not that JadeProx uses any single novel technique. Rather, it is the way the operators integrate widely available offensive tools, older critical vulnerabilities, custom loader development, legitimate signed binaries, and geographically specific lures into a flexible intrusion model.

JadeProx appears designed to find exposed systems at scale, convert selected systems into durable access points, and then deliver tailored Windows payloads when the operational opportunity warrants it.

KEY INTELLIGENCE JUDGMENTS

MODERATE CONF.

JadeProx is best assessed as a China-nexus intrusion cluster, not yet a conclusively identified organization. Its tooling, infrastructure preferences, language artifacts, and operational patterns strongly align with the broader Chinese cyber-espionage ecosystem. The evidence does not support confidently assigning it to Mustang Panda, Earth Lusca, Tropic Trooper, UAT-5918, APT27, or another established group.

HIGH CONF.

The operation blends opportunistic discovery with deliberate targeting. The Hong Kong campaign used automated scanning against more than 14,000 URLs, while the Vietnamese, Malaysian, Honduran, and Venezuelan activity showed more focused victim selection and operator interaction.

HIGH CONF.

Internet-facing applications are the operation’s principal entry point. JadeProx prioritizes public-facing Java applications, web-management interfaces, network appliances, content-management systems, and other systems affected by critical vulnerabilities.

HIGH CONF.

Webshells and proxy tunnels form the operational backbone. Tools such as suo5, Neo-reGeorg, iox, NPS, and SOCKS5 utilities allow the operators to convert compromised servers into concealed access and pivot infrastructure.

HIGH CONF.

TriBack Loader provides a reusable delivery layer. The loader enables JadeProx to change signed host executables, encrypted payloads, execution APIs, and final-stage malware while retaining a consistent underlying architecture.

ANALYTIC NOTE

JadeProx should be hunted through behavioral combinations rather than malware hashes alone. Signed executables running from unusual directories, malicious companion DLLs, encrypted .dat or .log files, Startup-folder persistence, nested _CL_###### directories, and uncommon callback-based shellcode execution provide more durable detection opportunities.

THE OPSEC FAILURE THAT EXPOSED THE OPERATION

The breakthrough began with the discovery of 43.106.71[.]28:8000, an Alibaba Cloud instance hosted in Singapore.

The operators had left a Python HTTP server running with directory indexing enabled. An exposed SSH service was also present. Instead of revealing only a few malware samples, the server exposed the operational workspace itself.

Researchers could reconstruct portions of the campaign from:

• Shell command history

• Webshell URLs and victim paths

• Vulnerability-scanning output

• Reverse-proxy and tunneling tools

• Phishing archives

• Loader packages

• Command-and-control configurations

• Cloud-monitoring evasion scripts

• Internal reconnaissance utilities

This distinction matters. Malware analysis normally reveals what a payload can do. An exposed operator workspace can reveal how the adversary works: how tools are installed, which attempts fail, how operators troubleshoot access, which targets receive manual attention, and how infrastructure is repurposed during different operational phases.

The resulting evidence provided a rare view of simultaneous intrusion activity across multiple countries and sectors.

MODUS OPERANDI

Phase One — Establish and Conceal Operator Infrastructure

JadeProx relied heavily on cloud-hosted infrastructure, particularly Alibaba Cloud and Alibaba Object Storage Service resources. The operators also used domains registered through NameSilo, with several services protected or obscured through Cloudflare.

One of the first actions visible in the exposed shell history was the execution of a modified version of fuckaliyun.sh, a publicly available script designed to disable or interfere with Alibaba Cloud Shield and Yundun host-monitoring components.

The JadeProx version was not a direct copy. The operators removed a call to rescue_localhost_name, a function that could expose the host’s rescue name to Alibaba. Group-IB assessed that this modification indicated the actors controlled the cloud account and were attempting to suppress visibility from Alibaba’s own security systems rather than merely tampering with a previously compromised instance.

Two additional functions were present but apparently never invoked:

• A function for downloading and launching a Go-based SOCKS5 proxy from a private Alibaba OSS bucket

• A function for compiling and launching an XMRig proxy

These components show that the infrastructure had been prepared for more than one operational purpose. The SOCKS5 capability could provide covert relay infrastructure. The XMRig proxy could support cryptocurrency-mining traffic or provide another use for infrastructure during periods when active intrusion operations were idle.

The mining interpretation remains an analytic inference. The exposed code demonstrated capability and preparation, but it did not prove that JadeProx actually conducted mining through the server.

Phase Two — Discover Internet-Facing Attack Surface

JadeProx used automated reconnaissance to identify vulnerable public-facing infrastructure.

The largest exposed targeting file was associated with the Hong Kong education sector. The targets.txt file contained 14,653 URLs across 117 service ports, including:

• HTTP and HTTPS

• Remote Desktop Protocol

• Secure Shell

• File Transfer Protocol

• MySQL

• WHOIS services

• Domain-registration services

• eduGAIN infrastructure

• Content-delivery endpoints

Duplicate entries, subdomains, raw IP addresses, and non-web ports indicated that the list had been generated or enriched through automation rather than assembled manually.

The same file also contained a small group of suspicious artificial-intelligence-themed wealth and stock-trading domains using the .top top-level domain. Those domains had reportedly been registered through XinNet Technology Corporation between November 2025 and February 2026. Their precise relationship to the operation remains unclear.

JadeProx installed the Nuclei vulnerability scanner and configured it to use only critical-severity templates. The resulting scan identified 13 distinct vulnerabilities across the target set.

This approach demonstrates a deliberate effort to reduce noise. Rather than indiscriminately testing every available template, the operator prioritized flaws likely to provide immediate remote access or code execution.

Phase Three — Exploit Public-Facing Systems

The exposed history showed follow-on activity against several critical vulnerabilities, including:

• CVE-2018-11511 — SQL injection affecting the photo-gallery functionality in ASUSTOR Data Master

• CVE-2021-24139 — Unauthenticated SQL injection affecting the 10Web Photo Gallery WordPress plugin

• CVE-2021-31755 — Stack-based buffer overflow affecting Tenda AC11 routers

• CVE-2021-32305 — Arbitrary command execution affecting WebSVN

Each was rated critical with a CVSS base score of 9.8 in the cited research. NVD independently describes CVE-2018-11511 as a remotely exploitable SQL-injection vulnerability and CVE-2021-31755 as a remotely reachable Tenda AC11 stack-overflow vulnerability capable of arbitrary code execution.

The age of these vulnerabilities is operationally significant. JadeProx does not appear dependent on zero-days. Its operators can gain meaningful access by finding public-facing systems that remain unpatched years after disclosure.

This reflects a recurring espionage reality: advanced downstream malware does not require advanced initial access when vulnerable perimeter systems remain exposed.

Phase Four — Deploy Webshells and Establish Tunnels

Once access was obtained, JadeProx relied on webshells and proxy utilities to create stable communications paths.

Against a Vietnamese public hospital, the operator deployed the suo5 SOCKS5-over-HTTP tunnel against a Picture Archiving and Communication System server. PACS platforms store and manage medical imagery such as X-rays, computed-tomography scans, and magnetic-resonance images.

The exposed history documented two webshell attempts against the hospital’s PACS environment through a Java Management Extensions path. A second subdomain belonging to the same hospital was also compromised through a different Java-based application and used another tunneling port.

Against a Malaysian government department identified by Group-IB as the Ministry of Foreign Affairs, the operator downloaded Neo-reGeorg, an HTTP tunnel designed to operate through webshells.

The first attempt failed. The operator then installed the curl-cffi Python dependency while troubleshooting another attempt and started several Netcat reverse-shell listeners across different ports.

These command sequences demonstrate interactive operator involvement. JadeProx was not merely launching a fully automated exploit chain; its personnel were debugging dependencies, changing ports, testing communication channels, and adapting to individual victim environments.

Phase Five — Reconnoiter and Pivot Through Victim Networks

The exposed toolkit included several utilities commonly used after initial compromise:

The operators renamed fscan as sys.log, illustrating simple masquerading intended to make the reconnaissance binary appear less suspicious during casual review.

They also attempted to download ChromElevator, a post-exploitation tool targeting Chrome’s App-Bound Encryption protections. That download attempt failed, but its presence in the command history indicates an interest in browser credential or cookie theft after access had already been established.

The combination of webshells, internal scanning, credential-access tooling, and multiple proxy technologies is consistent with operations seeking durable access and deeper network penetration.

Cisco Talos has documented comparable use of public-facing application exploitation, webshells, fscan, and Neo-reGeorg in UAT-5918 activity. That overlap supports the China-nexus assessment but is not sufficient to establish that JadeProx and UAT-5918 are the same actor.

TRIBACK LOADER: A REUSABLE EXECUTION LAYER

At the center of the operation is TriBack Loader, a custom shellcode loader identified across four infection chains.

The loader generally follows a three-component structure:

When the legitimate executable starts, Windows loads the malicious DLL from the same directory. The DLL locates the encrypted companion file, reverses its bytes, applies a rolling XOR operation, and executes the recovered shellcode.

The loader’s name reflects this recurring three-component architecture.

TriBack’s value is modularity. The operator can rotate the signed executable, malicious DLL, encryption key, callback API, lure, and final payload without rebuilding the entire delivery model.

The four documented variants used different signed binaries and execution methods, but repeated API sequences suggest that they were produced by a common custom builder.

CALLBACK EXECUTION AND EDR EVASION

Instead of consistently invoking highly monitored APIs such as CreateThread, TriBack Loader used less conventional Windows callback and thread-creation mechanisms.

InitOnceExecuteOnce

The exposed staging-server sample used InitOnceExecuteOnce, a Windows initialization callback mechanism. By registering malicious code as an initialization callback, the loader can execute shellcode through an API that may receive less scrutiny than direct thread creation.

TimerQueue Callbacks

The Honduras-focused variant registered the decrypted payload as a timer callback. This permits execution through the Windows timer-queue mechanism rather than through an obvious call to CreateThread.

EtwpCreateEtwThread

The Claude-themed variant dynamically resolved the undocumented EtwpCreateEtwThread function from ntdll.dll. The loader used the function to create an execution context for the decrypted payload.

These techniques do not make TriBack invisible. They are intended to move execution away from the most heavily monitored behavioral paths and complicate detection based on a small number of suspicious APIs.

The more reliable detection opportunity is the complete sequence: an unusual signed executable loads a neighboring DLL, reads an encrypted companion file, changes memory permissions or prepares executable memory, and transfers execution through a callback mechanism.

FINAL PAYLOADS

AdaptixC2

Two TriBack variants delivered AdaptixC2, an open-source post-exploitation and adversary-emulation framework.

Group-IB extracted complete beacon configurations, including command-and-control domains, RC4 keys, HTTP profiles, watermark values, sleep behavior, and user-agent strings.

The two principal AdaptixC2 domains were:

• sylverixstrategy[.]com

• gouvvbo[.]top

Both were registered through NameSilo near the compilation dates of their associated payloads.

AdaptixC2 supports command execution, file transfer, data exfiltration, multiple beacon formats, SOCKS proxying, port forwarding, and extensible post-exploitation modules. Unit 42 has independently documented its use in real-world criminal and intrusion activity.

One JadeProx configuration contained a GitHub analytics cookie resembling one observed in a customized Tropic Trooper beacon profile. This is a useful correlation point, but not a definitive attribution marker. Shared configurations, copied profiles, and reused open-source framework components can produce misleading overlaps.

Beagle Backdoor

A third TriBack variant was distributed through a fake Claude-Pro campaign.

The infection chain appeared in a ZIP archive named Claude-Pro-Relay-Technical-Overview.zip and in an MSI installer hosted through the fraudulent claude-pro[.]com domain.

The campaign used:

• A Claude-themed decoy document

• A Chinese-language MSI installation process

• A legitimate G DATA Security executable

• A malicious sideloaded DLL

• An encrypted payload

• Startup-folder persistence

• A DonutLoader shellcode stage

• The Beagle backdoor

Sophos independently analyzed the fake Claude infrastructure in May 2026 and identified Beagle as a previously undocumented backdoor. Its command set supported shell-command execution, file upload and download, directory creation, file listing, renaming, deletion, and self-removal. Sophos observed communications with license[.]claude-pro[.]com over TCP port 443 and UDP port 8080.

The MSI chain also created a double-extension self-deletion script named ~del.vbs.bat, which waited briefly before deleting the preceding VBS component.

This artifact provides defenders with a relatively distinctive hunting opportunity.

DeviceSync Variant

The fourth TriBack variant was recovered from an archive named DeviceSync.zip.

It used a Microsoft Malware Protection Copy Accelerator-related signed binary and a malicious companion DLL. Group-IB noted that related Microsoft utilities have previously appeared in Mustang Panda DLL-sideloading operations.

The encrypted .log payload required to reconstruct the final stage was not available. Consequently, the final malware could not be determined.

The evidentiary value of this variant lies in its loader structure and encryption overlap, not its unrecovered payload.

TARGETING BEYOND SOUTHEAST ASIA

JadeProx’s activity extended into Latin America.

Honduras

Researchers identified an archive named Estado de Cuenta.zip, uploaded from Honduras in March 2026. It contained a lure impersonating Cervecería Hondureña and presented an account statement for approximately 57,000 Honduran lempiras.

The intended recipient was identified as the National Congress of Honduras.

The archive used a nested _CL_177387 folder, a shortcut, VBS execution, a decoy document, DLL sideloading, TriBack Loader, and an AdaptixC2 payload.

The localized company identity, currency, payment theme, and named government recipient indicate purposeful targeting rather than a generic malware distribution campaign.

Venezuela

The gouvvbo[.]top infrastructure also hosted a credential-harvesting portal impersonating the municipal tax-management system for Piar Municipality in Bolívar state.

The portal requested personal information and documents including tax-registration information, previous payment receipts, and certificates. It simultaneously provided visual cover for infrastructure used by an AdaptixC2 beacon.

This dual-purpose approach increases infrastructure credibility. A functioning website can make a domain appear less suspicious to automated reputation services and casual human inspection while also collecting valuable information from targets who interact with it.

INFRASTRUCTURE PATTERN

The identified infrastructure followed a relatively consistent model:

• Domains registered through NameSilo

• Alibaba Cloud and Alibaba OSS usage

• DigitalOcean and other commodity cloud hosting

• Cloudflare fronting on selected domains

• Let’s Encrypt or Cloudflare Origin certificates

• Legitimate-looking corporate or government portals

• Security-vendor lookalike domains

• C2 domains created close to malware compilation dates

Observed domains included:

• sylverixstrategy[.]com

• gouvvbo[.]top

• license[.]claude-pro[.]com

• vertextrust-advisors[.]com

• update-trellix[.]com

• update-crowdstrike[.]com

• update-sentinelone[.]com

The exposed staging server and license[.]claude-pro[.]com infrastructure were both associated with Alibaba-linked autonomous-system infrastructure, providing another correlation point between the operational server and the malware-delivery environment.

ATTRIBUTION ASSESSMENT

Group-IB places JadeProx firmly within the China-nexus threat ecosystem based on the cumulative evidence:

• Chinese-origin tunneling and reconnaissance utilities

• Heavy use of Alibaba infrastructure

• A modified Alibaba security-evasion script

• Chinese-language installation content

• NameSilo and Cloudflare infrastructure patterns

• DLL sideloading through signed executables

• Regional government, healthcare, and education targeting

• Operational overlaps with multiple documented China-nexus clusters

These overlaps should not be treated as proof of identity.

China-nexus operators routinely share or independently adopt the same open-source utilities, loader concepts, hosting providers, registrars, and intrusion techniques. The same tool may appear across intelligence, military, contractor, and criminally adjacent operations.

Group-IB’s decision to track JadeProx as a separate cluster is therefore analytically sound. The most reliable correlation anchors are:

• TriBack Loader’s architecture

• XOR-key relationships

• Repeated API sequences

• Nested folder conventions

• Infrastructure-registration patterns

• Associated phishing and C2 domains

Attribution to a specific named group would currently exceed the available evidence.

DEFENSIVE PRIORITIES

1. Reduce Public-Facing Attack Surface

Inventory every internet-facing application, management console, appliance, Java service, remote-access portal, and content-management plugin.

Prioritize:

• Unsupported products

• End-of-life software

• Critical vulnerabilities

• Public-facing systems with CVSS scores of 9.8 or higher

• Java management interfaces

• NAS administration services

• Router management portals

• WordPress plugins

• Systems that cannot be centrally monitored

2. Hunt for the TriBack Three-File Pattern

Search for directories containing:

• A legitimate signed executable

• An unexpected neighboring DLL

• A .dat or .log companion file

Give additional weight when the files appear in:

• %TEMP%

• %APPDATA%

• %PROGRAMDATA%

• User profile directories

• SquirrelTemp directories

• Windows Startup folders

• Extracted ZIP directories

• Other user-writable paths

3. Detect Signed-Binary Abuse

Alert when signed vendor executables run from directories inconsistent with their normal installation paths.

Relevant names may include:

• avk.exe

• Microsoft Service Hub executables

• Malware Protection Copy Accelerator components

• Other signed binaries loading hostfxr.dll, avk.dll, or MpClient.dll from the local working directory

The filename alone is not malicious. The suspicious condition is the combination of location, neighboring files, DLL load behavior, and subsequent memory execution.

4. Hunt for Campaign Artifacts

Search endpoint, email, proxy, and archive telemetry for:

• _CL_###### directory structures

• ~del.vbs.bat

• Claude-Pro-themed archives

• Estado de Cuenta.zip

• DeviceSync.zip

• Unexpected VBS files launching signed executables

• MSI packages writing executable components into Startup locations

• .lnk files invoking VBS, FTP scripting, or nested archive content

5. Monitor Webshell and Tunneling Activity

Detect or investigate:

• Long-lived HTTP requests to unusual scripts

• High-volume bidirectional traffic through web applications

• Web servers initiating outbound connections

• SOCKS-like traffic over HTTP

• Unusual processes spawned by Java application servers

• Neo-reGeorg, suo5, iox, NPS, or fscan artifacts

• Netcat listeners on public-facing servers

• Multiple tunneling utilities appearing on the same host

6. Detect Callback-Based Shellcode Behavior

EDR detections should correlate:

• A nonstandard executable path

• Local DLL sideloading

• Reads of encrypted .dat or .log files

• Byte transformation or decryption loops

• Memory allocation and permission changes

• Calls to InitOnceExecuteOnce

• TimerQueue callback registration

• Dynamic resolution of EtwpCreateEtwThread

• Execution of memory lacking normal image backing

7. Block and Retrospectively Search Network Indicators

Block confirmed malicious domains and IP addresses at DNS, secure web gateway, firewall, proxy, and email-security layers.

Historical searches should determine whether any endpoint:

• Resolved the domains

• Connected to the associated IP addresses

• Downloaded files from the infrastructure

• Submitted credentials to the fake portals

• Communicated over unusual ports such as UDP 8080

• Exhibited beacon-like periodicity

STRATEGIC IMPLICATIONS

JadeProx demonstrates how modern espionage operations can combine customized malware with inexpensive and widely available infrastructure.

The operators did not need to invent every component. They assembled an operational system from:

• Public vulnerability scanners

• Open-source tunnels

• Webshells

• Commodity cloud services

• Legitimate signed executables

• Public post-exploitation frameworks

• Custom loader development

• Localized phishing content

The custom engineering was concentrated where it produced the greatest operational value: payload execution, detection evasion, and flexible delivery.

The exposed server also shows that sophisticated adversaries remain vulnerable to basic mistakes. JadeProx invested in custom loader development and cloud-security evasion, yet a Python HTTP directory exposed much of the campaign.

For defenders, however, the larger lesson is uncomfortable: the operator’s mistake revealed how much access could be obtained through vulnerabilities disclosed in 2018 and 2021.

JadeProx’s advanced tradecraft begins after organizations fail to close basic perimeter exposure.

CONCLUSION

JadeProx represents a capable, adaptable, and still-emerging China-nexus intrusion cluster.

Its modus operandi combines automated vulnerability discovery, selective exploitation, webshell deployment, covert tunneling, internal reconnaissance, targeted phishing, signed-binary abuse, callback-based shellcode execution, and interchangeable post-exploitation payloads.

TriBack Loader provides the technical continuity across these activities. It gives the operators a repeatable delivery architecture while allowing them to rotate lures, host binaries, callback APIs, encrypted payloads, and command-and-control frameworks.

The available evidence supports tracking JadeProx as a distinct cluster rather than forcing it into an existing attribution label. Future campaigns should be correlated through the loader’s implementation, infrastructure patterns, encryption relationships, campaign artifacts, and behavioral execution chain.

The defensive priority is equally clear: patch internet-facing systems, detect webshell-to-tunnel transitions, monitor signed executables outside their expected locations, and hunt for the three-file sideloading pattern that defines TriBack Loader.

JadeProx may be a newly named cluster, but the conditions that enable it are longstanding — and, in many environments, still unresolved.