Group-IB

🚨A single OPSEC mistake exposed an entire China-nexus operation. An exposed Alibaba Cloud staging server provided a rare view into an active threat operation. The infrastructure revealed attacker tooling, bash history, victim paths, and post-exploitation activity, leading to the discovery of a previously undocumented threat cluster we track as JadeProx. Key Highlights: 🔹Discovery of TriBack Loader, a previously undocumented malware family observed across four infection chains. 🔹Targeting of government, healthcare, and education organizations across Southeast Asia, alongside phishing campaigns in Latin America. 🔹Abuse of signed Microsoft and G DATA binaries for DLL sideloading and payload execution. 🔹Use of InitOnceExecuteOnce, TimerQueue callbacks, and EtwpCreateEtwThread for evasion. 🔹Deployment of AdaptixC2 and the Beagle backdoor through a shared loader architecture. 🔹Large-scale vulnerability scanning, credential harvesting, and tunneling activity. 🔗 Read the full blog #ThreatIntelligence