China-Nexus Jade Prox Uses New Tri Back Loader in Government and Healthcare Attacks
Summary: Group-IB found an exposed Alibaba Cloud server in Singapore in mid-April 2026 that revealed a China-nexus operation it tracks as JadeProx, which targeted government, healthcare, and education organizations in Asia and Latin America with a previously undocumented Windows loader called TriBack Loader. The server's bash history and tooling showed active intrusions against a Vietnamese public hospital's medical imaging system and Malaysia's Ministry of Foreign Affairs, plus a Nuclei scan of 14,653 Hong Kong education-related URLs that surfaced 13 unique vulnerabilities.
Why it matters: The scanning half of this operation ran on flaws disclosed in 2018 and 2021, including CVE-2021-31755 in Tenda AC11 routers, which has sat on CISA's Known Exploited Vulnerabilities catalog since November 3, 2021 - the custom loader engineering all sits downstream of a break-in that patching would have closed.
Read the original at The Hacker News ↗
- Mentions
- CVE-2018-11511CVE-2021-24139CVE-2021-31755CVE-2021-32305
- Related
- CVE-2021-31755: Tenda AC11 Router Stack Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021