China-linked hackers merged espionage and mass malware in one loader

A China-linked espionage cluster simultaneously breached a Vietnamese hospital’s medical imaging system, Malaysia’s Ministry of Foreign Affairs, and Honduras’s National Congress, while pushing the same custom malware to consumers searching for the Claude AI chatbot, Group-IB disclosed on July 23, 2026.

The operation used TriBack Loader, a Windows loader that evaded all major endpoint detection products by cycling through four obscure APIs. An attacker’s staging server left visible on Alibaba Cloud Singapore exposed a complete campaign record, including active intrusions and tunneling tools.

The intruders who broke into a Vietnamese hospital’s imaging network earlier this year deployed a Windows loader designed to dodge every major endpoint security product. Group-IB, which published its analysis on July 23, 2026, calls it JadeProx.

The same loader, called TriBack, landed on the computers of ordinary users who searched for the Claude AI chatbot and clicked a sponsored link. That link pointed to a convincing fake installer on claude-pro.com, not to Anthropic’s real site.

For months, the same infection chain delivered targeted intelligence collection inside Asian governments and a backdoor onto home PCs. The line between state espionage and mass malware had become a shared delivery mechanism.

The loader that hid in plain sight, then exposed itself

Group-IB discovered JadeProx in mid-April 2026 when an attacker’s staging server at IP 43.106.71.28, hosted on Alibaba Cloud Singapore, had port 8000’s directory listing enabled. The open listing revealed TriBack Loader builds, tunneling tools, vulnerability scanners, and a bash history showing active intrusions against a Vietnamese hospital, Malaysia’s Ministry of Foreign Affairs, and a phishing campaign aimed at Honduras’s National Congress. The server also contained a script called fuckaliyun.sh designed to disable Alibaba Cloud’s own security agent, and a SOCKS5 proxy alongside an XMRig cryptocurrency miner.

That rare visibility is what makes JadeProx traceable. Normally, TriBack would leave few footprints. It uses DLL side-loading: a legitimate signed executable loads a malicious DLL, which in turn decrypts an encrypted payload file. The execution then passes through callback APIs like InitOnceExecuteOnce or EtwpCreateEtwThread, which endpoint detection tools rarely monitor deeply.

The infection chain below maps how that evasion plays out, step by step.

The Vietnamese hospital was breached through an exposed JMX interface on a public-facing subdomain. Attackers planted webshells, then used the suo5 tunneling tool to route traffic into the internal PACS network—a system that stores every diagnostic image and patient identifier. Two separate tunneling sessions pointed to multiple footholds. In Malaysia, a similar pattern: webshells planted, tunneling deployed, with an initial attempt failing due to a missing dependency before the operators debugged and tried again.

In Honduras, the National Congress received a phishing email with a decoy invoice from Cervecería Hondureña for 57,000 lempiras—roughly US$2,129 at the July 23 exchange rate of 26.7773 HNL to the dollar. The zip attachment delivered the same TriBack chain.

While those intrusions were under way, TriBack also appeared in a consumer-facing malvertising campaign. A fake Claude AI installer, hosted on claude-pro.com and likely promoted as a sponsored search result, deployed a backdoor called Beagle that gave operators remote command execution, file transfer, and directory management on any machine where a user approved a Windows UAC prompt. The same loader built for espionage was now infecting anyone searching for Claude.

The operation exploited years-old vulnerabilities that security teams had long been told to patch. The operators scanned 14,653 Hong Kong education-sector URLs and identified 13 critical vulnerabilities. Four of those CVEs, each scoring 9.8 on the CVSS scale, were then manually exploited: CVE-2018-11511, CVE-2021-24139, CVE-2021-31755, and CVE-2021-32305. The Tenda router flaw, CVE-2021-31755, has been in CISA’s Known Exploited Vulnerabilities catalog since November 3, 2021, with a federal remediation deadline that expired two weeks later.

The breadth of targets—hospitals, a foreign ministry, a legislature, consumers—raises a harder question. Why would a China-linked campaign push the same loader to random users searching for an AI tool?

Why the same loader hit a hospital and a home PC

TriBack’s dual use is not an accident of design; it reflects low marginal costs. After developing a loader that evades EDR, repurposing it for malvertising requires only a domain, a fake site, and a search ad. The infrastructure already spanned Alibaba Cloud, DigitalOcean, and Cloudflare.

Group-IB declined to pin JadeProx on a single group, pointing to overlapping tools used by Mustang Panda, Earth Lusca, and Tropic Trooper. That diffusion blurs attribution but gives defenders a chance: detection signatures built for TriBack could disrupt multiple clusters. An AdaptixC2 beacon configuration containing a GitHub analytics cookie that Group-IB linked to a profile previously documented with Tropic Trooper suggests possible shared supply chains, though Group-IB stopped short of equating the clusters.

Regulatory gaps deepen the problem. Vietnam’s new data protection law, Malaysia’s PDPA, and Honduras’s statutes lack mandatory healthcare or government breach notification. Western officials treated in that Vietnamese hospital have no clear way to learn if their records were touched.

The rise of AI-branded lures—seen in recent ransomware campaigns—makes the Claude installer a textbook example. Once Beagle is on a machine, it can reach cloud consoles and SaaS platforms, linking a Latin America-focused campaign to Western enterprise networks through compromised endpoints. The same loader a ministry firewall missed is now inside a user’s startup folder.

The separation between targeted espionage and mass infection has collapsed into a single loader. Whether Western agencies issue a coordinated advisory in the coming weeks will determine if the remaining infected machines—in hospitals, ministries, and on home PCs—are found or left silent.

Beyond the headline

The Bigger Picture

The growing reuse of code and infrastructure among Chinese-nexus clusters makes precise attribution increasingly difficult, which complicates diplomatic response. When the same loader appears in four different threat groups’ arsenals, the traditional “name and shame” approach loses teeth—and victims are left with technical indicators, not a clear adversary.

What Isn’t Being Said

The absence of mandatory breach disclosure in affected jurisdictions creates a trust vacuum. Western intelligence agencies that rely on regional partners for threat intelligence cannot assess whether their own diplomats’ records were compromised, while hospitals with international affiliations face unquantified legal and reputational risk. The opacity feeds a cycle where incidents go unacknowledged and defenses remain static.

The Reach

One underappreciated implication is for Western identity and access management: if Beagle lands on machines used for cloud consoles or AI coding assistants, operators gain a foothold inside Western SaaS ecosystems without breaching those providers. That creates a secondary exposure channel where a Latin America-focused campaign becomes a route into US and EU enterprise environments through compromised user devices and tokens.

The triage list for defenders and users

With the JadeProx operation now mapped and indicators public, defenders and consumers face a narrow window to close the gaps the attackers exploited.

• Western cybersecurity professional managing EDR systems

  Review your EDR configurations to flag callback APIs like InitOnceExecuteOnce and EtwpCreateEtwThread, which TriBack exploits. Look for signed vendor binaries running from user-writable directories, especially when an encrypted .dat file sits alongside them. Group-IB’s indicators can be imported to detect these patterns before they trip your own alerts.

• Western IT manager with unpatched legacy systems

  Audit your network for the four CVEs used in this campaign—CVE-2018-11511, CVE-2021-24139, CVE-2021-31755, and CVE-2021-32305—prioritizing patching or isolating exposed instances. CISA’s Known Exploited Vulnerabilities catalog marks CVE-2021-31755 as actively exploited, so treat the list as a prioritized patch queue, not a reference document.

• Western individual searching for AI software downloads

  Verify you are on anthropic.com before downloading Claude; there is no standalone Windows desktop installer. Avoid clicking sponsored search results for software, and use browser protections that flag typosquatted AI-related domains.

• Western investor with Latin American emerging market exposure

  Reassess political-intelligence risks in your portfolio: espionage targeting legislatures and municipal tax data can shift regulatory outcomes or expose sensitive commercial relationships. Monitor local data-protection enforcement trends and incorporate cyber-risk assessments into due diligence for investments in the region.

FAQ

Explainer

TriBack Loader

A custom Windows malware loader used by the JadeProx cluster that chains a legitimate signed program with a malicious DLL and an encrypted payload file. When executed, it decrypts shellcode and hands off execution to rarely monitored Windows APIs, letting it bypass endpoint detection tools. Its decryption routine first reverses bytes and then applies a rolling XOR, a pattern common in Chinese APT loaders.

DLL side-loading

A technique where attackers place a malicious DLL in the same directory as a trusted, signed executable, exploiting the Windows search order so the system loads the rogue library without verifying its signature. The legitimate program runs as normal, but its actions are now controlled by the attacker’s code. Even when the attacker’s DLL isn’t WHQL-signed, Windows may still load it because the search path prioritizes the local directory.

PACS

Picture Archiving and Communications System, a medical imaging server that stores, retrieves, and distributes diagnostic images such as X-rays, CT scans, and MRIs. It typically holds DICOM-format files that embed patient identifiers, exam details, and clinician notes, making breached PACS systems a rich source of intelligence on individuals’ health histories. In the JadeProx case, the attackers tunneled into the hospital’s PACS network to reach these records.

AdaptixC2

An open-source post-exploitation command-and-control framework that provides operators with a flexible platform for lateral movement, credential theft, and data exfiltration after an initial breach. Because its code is public, multiple threat groups can independently adopt and customize it, as seen with both JadeProx and the earlier Tropic Trooper cluster. Its plugin system allows operators to extend capabilities with custom modules.

CISA KEV catalog

CISA’s Known Exploited Vulnerabilities catalog is a publicly maintained list of software flaws that have been actively used in cyberattacks. US federal agencies are required to remediate listed CVEs within set deadlines, and private organizations are strongly encouraged to follow the same schedule. CISA updates the catalog when new evidence of active exploitation emerges, making it a real-time patching priority queue rather than a static reference.