China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks
JadeProx, a China-nexus threat actor, utilized an undocumented Windows loader named TriBack Loader to target government, healthcare, and education sectors in Asia and Latin America. The TriBack Loader employs DLL sideloading with legitimate signed executables, encrypted payloads, and rolling XOR keys to evade EDR detection via less-monitored Win32 API calls. Infection chains delivered Adaptix C2 or the Beagle backdoor, often distributed through spear-phishing campaigns impersonating Anthropic's
Analysis
TL;DR
- JadeProx, a China-nexus threat actor, utilized an undocumented Windows loader named TriBack Loader to target government, healthcare, and education sectors in Asia and Latin America.
- The TriBack Loader employs DLL sideloading with legitimate signed executables, encrypted payloads, and rolling XOR keys to evade EDR detection via less-monitored Win32 API calls.
- Infection chains delivered Adaptix C2 or the Beagle backdoor, often distributed through spear-phishing campaigns impersonating Anthropic's Claude software.
- Post-exploitation activities included scanning for critical vulnerabilities (CVSS 9.8) in legacy systems like ASUSTOR ADM and Tenda routers, exploiting unpatched internet-facing Java applications.
- Detection relies on identifying suspicious file layouts, such as signed binaries running from user-writable directories alongside encrypted .dat/.log files, rather than specific filenames.
Why It Matters
This incident highlights the evolving sophistication of supply-chain-adjacent attacks where threat actors leverage legitimate signed binaries to bypass security controls, making traditional signature-based detection ineffective. It underscores the critical risk of relying on outdated, high-severity vulnerabilities that have been known for years, demonstrating that advanced custom tooling is often secondary to basic hygiene failures like unpatched public-facing services. For AI and tech companies, the impersonation of popular tools like Claude serves as a warning about the increasing use of brand-jacking in phishing campaigns to distribute malware.
Technical Details
- TriBack Loader Mechanics: Uses DLL sideloading where a malicious DLL is paired with a legitimate signed executable. It reverses payload bytes, decrypts them using a rolling XOR key, and executes shellcode via Win32 calls such as
InitOnceExecuteOnce,TimerQueuecallbacks, or the undocumentedEtwpCreateEtwThreadto avoid standard thread creation monitoring. - Payloads and C2: Variants delivered Adaptix C2 (open-source post-exploitation framework) or Beagle backdoor (distributed via DonutLoader). One variant impersonated Anthropic’s Claude, using a fake MSI installer from
claude-pro[.]comfor persistence in the Windows Startup folder. - Targeted Vulnerabilities: Operators scanned 14,653 URLs in Hong Kong’s education sector, exploiting four CVEs with CVSS 9.8 scores: CVE-2018-11511 (ASUSTOR ADM), CVE-2021-24139 (10Web Photo Gallery), CVE-2021-31755 (Tenda AC11 routers), and CVE-2021-32305 (WebSVN).
- Infrastructure and Indicators: Staging server at
43.106.71.28(port 8000). Malicious domains includeclaude-pro[.]com,license[.]claude-pro[.]com, and security vendor lookalikes (update-trellix[.]com, etc.). File artifacts include nested_CL_######folders,~del.vbs.bat, and unexpected copies ofhostfxr.dll,avk.dll, orMpClient.dll.
Industry Insight
- Prioritize Legacy Patching: Despite the focus on novel loaders, the initial access vectors were well-known, high-severity vulnerabilities from 2018 and 2021. Organizations must enforce strict patch management for internet-facing assets, particularly legacy infrastructure and routers, as these remain primary entry points for advanced threats.
- Enhance Endpoint Visibility for Sideloading: Security teams should configure EDR solutions to flag anomalies in DLL sideloading scenarios, specifically monitoring for legitimate binaries executing from non-standard locations (e.g., Temp, Startup) accompanied by encrypted data files.
- Brand Impersonation Vigilance: With attackers increasingly mimicking popular AI brands like Claude, IT security awareness programs should educate users on verifying software sources and recognizing domain spoofing, while security operations centers should monitor for associated IOCs linked to these impersonation campaigns.
Disclaimer: The above content is generated by AI and is for reference only.