{"id":1088,"date":"2026-07-23T09:02:19","date_gmt":"2026-07-23T07:02:19","guid":{"rendered":"https:\/\/familiebuckens.nl\/?p=1088"},"modified":"2026-07-27T09:02:57","modified_gmt":"2026-07-27T07:02:57","slug":"china-nexus-jadeprox-uses-new-triback-loader-in-government-and-healthcare-attacks","status":"publish","type":"post","link":"https:\/\/familiebuckens.nl\/index.php\/2026\/07\/23\/china-nexus-jadeprox-uses-new-triback-loader-in-government-and-healthcare-attacks\/","title":{"rendered":"China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">An exposed Alibaba Cloud server has revealed a China-nexus operation that Group-IB tracks as&nbsp;<strong>JadeProx<\/strong>. The cluster has targeted government, healthcare, and education organizations across Asia and Latin America with a previously undocumented Windows loader called TriBack Loader.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Group-IB found the server in mid-April 2026 in Alibaba Cloud&#8217;s Singapore region; it was offline by the time the&nbsp;<a href=\"https:\/\/www.group-ib.com\/blog\/jadeprox-china-nexus-triback-loader\/\" target=\"_blank\" rel=\"noreferrer noopener\">report<\/a>&nbsp;published on July 23, 2026.<\/p>\n\n\n<a class=\"wp-block-read-more\" href=\"https:\/\/familiebuckens.nl\/index.php\/2026\/07\/23\/china-nexus-jadeprox-uses-new-triback-loader-in-government-and-healthcare-attacks\/\" target=\"_self\"><a href=\"https:\/\/thehackernews.com\/2026\/07\/china-nexus-jadeprox-uses-new-triback.html\">China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks<\/a><span class=\"screen-reader-text\">: China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks<\/span><\/a>","protected":false},"excerpt":{"rendered":"<p>An exposed Alibaba Cloud server has revealed a China-nexus operation that Group-IB tracks as&nbsp;JadeProx. The cluster has targeted government, healthcare, and education organizations across Asia and Latin America with a previously undocumented Windows loader called TriBack Loader. Group-IB found the server in mid-April 2026 in Alibaba Cloud&#8217;s Singapore region; it&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,17],"tags":[72,13],"class_list":["post-1088","post","type-post","status-publish","format-standard","hentry","category-geopolitics","category-vulnerability","tag-72","tag-china"],"_links":{"self":[{"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/posts\/1088","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/comments?post=1088"}],"version-history":[{"count":1,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/posts\/1088\/revisions"}],"predecessor-version":[{"id":1089,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/posts\/1088\/revisions\/1089"}],"wp:attachment":[{"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/media?parent=1088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/categories?post=1088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/familiebuckens.nl\/index.php\/wp-json\/wp\/v2\/tags?post=1088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}