OPSEC Error Uncovers TriBack Malware in Global Espionage Campaign

Key Takeaways

• A significant global espionage campaign, dubbed JadeProx, has been exposed due to an operational security (OPSEC) error by its operators.
• The campaign leverages a newly identified malware loader, TriBack, to compromise targets across various sectors including healthcare, government, and education.
• Victims span Southeast Asia and Latin America, with specific attacks observed against a Vietnamese hospital, the Malaysian Ministry of Foreign Affairs, and educational institutions in Hong Kong.
• TriBack Loader employs DLL sideloading and unusual Windows callback functions to evade detection, delivering payloads like AdaptixC2 beacons and the Beagle backdoor.
• Defenders should implement network-level blocks, hunt for specific file patterns, and prioritize patching of internet-facing applications and critical vulnerabilities to mitigate risks.

OPSEC Blunder Reveals Global Espionage Campaign Targeting Critical Sectors

An elementary operational security lapse by a state-sponsored threat actor has inadvertently unveiled an extensive global espionage operation. This sophisticated campaign, active since early 2026, has infiltrated diverse targets, including hospitals, government agencies, and educational institutions across multiple continents.

The exposure occurred in mid-April when the attackers left a staging server openly accessible. This server contained an array of tools, command histories, and pre-configured phishing packages, providing a rare glimpse into their active operations. This critical error brought to light the campaign, now designated as JadeProx, which primarily utilizes a previously undocumented malware loader named TriBack.

Initial targets identified within the campaign include a medical imaging system at a public hospital in Vietnam, the Malaysian Ministry of Foreign Affairs, and several educational websites in Hong Kong. Concurrently, separate but related activities were detected in Honduras, where attackers employed fake Claude software themes to entice victims into executing malicious packages.

Analysts at Group-IB were instrumental in identifying the malware and meticulously tracing the consistent presence of the TriBack loader across every compromised system they analyzed. According to a Group-IB report, TriBack Loader initiates its execution through DLL sideloading. It then decrypts and runs shellcode by leveraging standard Windows callback functions, a technique designed to bypass conventional security detection mechanisms.

The campaign deployed multiple TriBack variants. Two of these variants were observed to drop AdaptixC2 beacons, while another delivered a backdoor known as Beagle. The threat actors also established fraudulent portals on their infrastructure, including one masquerading as a Venezuelan municipal tax system, specifically designed to harvest credentials from unsuspecting visitors.

The geographical distribution of targets, stretching from Southeast Asia to Latin America, aligns with typical patterns associated with China-nexus espionage activities. For instance, a lure tailored for Honduras mimicked an official statement from a prominent local beverage company, directed towards the National Congress.

Threat Actors’ OPSEC Failure Exposes Attack Infrastructure

The adversary’s Alibaba Cloud staging server became accessible due to an unconfigured Python web server with directory listing enabled. This oversight left a wealth of sensitive information exposed, including bash histories, webshell paths, phishing kits, and various post-exploitation tools.

The exposed directories contained critical components such as port forwarders, SOCKS tunnels, network scanners, and scripts intended to obscure the server’s activity from cloud host monitoring systems. Analysis of command logs revealed active tunnels into the Vietnamese hospital’s imaging system and attempts to access Malaysian foreign affairs systems. The victim footprint, as illustrated in Group-IB’s findings, clearly spans both Southeast Asian (SEA) and Latin American (LATAM) regions.

Further examination of these logs demonstrated the actors’ method of delivering DLL sideloading packages to Windows hosts accessed via internal tunnels. A specific archive targeting Honduras was found to utilize a legitimately signed Microsoft host binary to load a malicious DLL, thereby bypassing common security alerts. Similarly, Claude-themed packages exploited other trusted vendor applications through analogous methods across various uploads. Cybersecurity professionals familiar with DLL sideloading techniques will recognize how trusted programs are subverted to discreetly launch subsequent stages of an attack.

TriBack Loader’s Evasion Techniques

TriBack Loader typically consists of a small set of files: a signed legitimate program, a malicious DLL, and an encrypted data file. Following a rapid decryption process that involves byte reversal and a rolling key, the malware executes its code using unconventional Windows callbacks, rather than standard thread creation mechanisms. This design choice enables it to circumvent many endpoint detection products that monitor for typical thread initiation patterns.

Researchers observed four distinct builds of TriBack over approximately two months. While each variant swapped host binaries and callback functions, they consistently maintained the same builder style. Two of these builds deployed AdaptixC2, with researchers successfully recovering full beacon settings, including sleep intervals and HTTP profiles.

A third variant employed shellcode to execute the Beagle backdoor, communicating with domains exhibiting a consistent registration pattern. The continued abuse of open-source frameworks like AdaptixC2 underscores their appeal to threat actors due to their effectiveness and accessibility.

What You Should Do

• Network Blocking: Immediately block all identified malicious domains and IP addresses at the network perimeter and DNS layer.
• Endpoint Hunting: Actively hunt for nested folders named with the pattern “_CL” followed by digits in mail and endpoint logs.
• DLL Sideloading Detection: Configure monitoring to flag signed vendor binaries executing from user-writable paths, especially when a companion data or log file is present in the same directory.
• Startup Folder Review: Regularly review entries in startup folders for suspicious executables or scripts.
• Cleanup Script Detection: Watch for artifacts such as double-extension cleanup scripts (e.g., ~del.vbs.bat).
• Vulnerability Management: Prioritize patching for all internet-facing Java applications and address any unpatched critical vulnerabilities immediately.
• Threat Intelligence Integration: Integrate the provided Indicators of Compromise (IoCs) into your threat intelligence platforms (e.g., MISP, VirusTotal, SIEM) for enhanced detection and correlation.

Indicators of Compromise (IoCs)

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.