SHA-1 Hash
In mid-April 2026, an exposed directory on an Alibaba Cloud server revealed a comprehensive China-nexus operation targeting government, healthcare, and education sectors across Southeast Asia and Latin America. The investigation uncovered simultaneous intrusions against Vietnamese hospitals, the Malaysian Ministry of Foreign Affairs, Hong Kong educational institutions, and targets in Honduras and Venezuela. At the center is TriBack Loader, a custom malware family using DLL sideloading with signed binaries and Win32 callback APIs to deliver AdaptixC2 and Beagle backdoors. The exposed server contained post-exploitation toolkits, bash history, and victim paths, revealing ongoing operations. Infrastructure analysis showed consistent use of NameSilo registrations, Alibaba hosting, and Cloudflare fronting. Phishing campaigns included fake portals impersonating Venezuelan tax systems and Claude-Pro software. The operation demonstrates shared tooling common across Chinese APT groups, with TTPs...
No sightings recorded yet