Adversary Intelligence — 2026-07-26

China-Nexus Espionage Campaign Exposed After Operators OPSEC Failure Reveals TriBack Malware Targeting Malaysian Foreign Ministry and Vietnamese Hospital Systems

BLUFChina-nexus operators sharing callback-API loaders that bypass standard EDR hooks can reconstitute this campaign from fresh infrastructure faster than defenders can attribute and block it.

Group-IB reported that an exposed Alibaba Cloud staging server in Singapore, discovered in mid-April after operators left a Python web server's directory listing open, revealed an active China-nexus campaign it tracks as JadeProx 12. Bash history on the server documented intrusions against a Vietnamese public hospital's medical imaging system, Malaysia's Ministry of Foreign Affairs, and Hong Kong education-sector websites, alongside a parallel phishing campaign against Honduras's National Congress 13. The campaign uses a previously undocumented loader, TriBack, which employs DLL sideloading and Windows callback APIs to execute shellcode across four variants, two delivering AdaptixC2 beacons and a third a backdoor named Beagle 14. Tech Times reported that Beagle's command-and-control infrastructure also linked to a phishing site impersonating Anthropic's Claude AI software registered in late March, which Sophos separately assessed as likely malvertising 3. Group-IB also found the same campaign infrastructure hosting a live credential-harvesting portal impersonating a Venezuelan municipal tax authority, the Alcaldia Bolivariana del Municipio Piar, targeting a Bolivar state jurisdiction with documented Chinese economic interests 1.

Analysis
Group-IB's Singapore staging-server exposure closes that node but leaves JadeProx's core capability intact: TriBack Loader's four variants execute shellcode through callback APIs that most EDR products instrument less closely than CreateThread or VirtualAlloc, so detection gains here are narrow. Group-IB withheld attribution despite tooling overlaps with Mustang Panda, Earth Lusca, UAT-5918, and Tropic Trooper, a restraint that points to a shared-toolkit ecosystem among China-nexus operators outrunning infrastructure- and TTP-based attribution, though the overlap could equally reflect a shared contractor pool serving separate operators rather than one coordinated campaign. Reporting rests entirely on Group-IB's technical writeup, with wire outlets republishing it. The shift toward a Claude-branded malvertising lure shows these operators now reaching consumer search traffic for initial access, extending exposure beyond the named government, hospital, and municipal targets already compromised.

4 sources

JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake - Group-IB
Hackers OPSEC Mistake Exposed a Global Espionage Campaign and Its New TriBack Malware - Cyber Security News
China-Nexus Hackers Breached Hospital X-Rays, Embassy, and Congress With New Malware Loader - Tech Times
China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks - The Hacker News