China-nexus JadeProx uses TriBack Loader for attacks

A recently published security analysis by Group-IB has uncovered a new threat from a China-nexus operation called JadeProx. This group specializes in attacks on government, healthcare, and educational institutions in Asia and Latin America. The report is based on the discovery of an exposed Alibaba Cloud Server found in April 2026 in the Singapore region.

The server was already offline when the analysis was completed, complicating the investigation. JadeProx uses a novel Windows Loader known as the TriBack Loader. This loader is undocumented so far and poses a serious threat to the affected sectors.

Attack Targets and Methods

The attacks by JadeProx specifically target organizations that are critical to public safety and healthcare. This includes government agencies, hospitals, and educational institutions that often hold sensitive data. The use of the TriBack Loader allows attackers to efficiently spread malware and compromise their targets.

Group-IB's security researchers have found that the attacks are conducted in multiple waves, with attackers initially breaching the networks of target organizations to then install their malware. This tactic enables them to take control of critical systems and steal or manipulate data.

The discovery of the TriBack Loader is particularly concerning as it is not only new but also specifically designed to meet the needs of the JadeProx group. The malware is designed to infiltrate existing systems unnoticed and can potentially cause significant damage.

Reactions and Security Measures

The revelations about JadeProx and the TriBack Loader have raised concerns in the cybersecurity community. Experts warn of the need to strengthen security protocols in the affected sectors. In particular, organizations in healthcare and public administration must regularly check their systems for vulnerabilities and ensure they have up-to-date security solutions.

Authorities in the affected regions have already begun taking measures to minimize the impact of the attacks. This includes improving network security and training staff to deal with cyber threats. Collaboration between different countries and organizations is seen as crucial to effectively combat the threat posed by JadeProx.

The discovery of the TriBack Loader and the associated attacks highlight the ongoing danger posed by state-sponsored hacker groups. The security situation in many countries remains tense as such groups continue to attempt to compromise critical infrastructures.

Investigations into JadeProx and the TriBack Loader are still ongoing, and further information about the group's methods and targets is expected to be released in the coming weeks. The cybersecurity community remains vigilant to respond quickly to new threats.