China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks post, juli 23, 2026juli 27, 2026 An exposed Alibaba Cloud server has revealed a China-nexus operation that Group-IB tracks as JadeProx. The cluster has targeted government, healthcare, and education organizations across Asia and Latin America with a previously undocumented Windows loader called TriBack Loader. Group-IB found the server in mid-April 2026 in Alibaba Cloud’s Singapore region; it was offline by the time the report published on July 23, 2026. China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks: China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks geopolitics vulnerability 2026China