jadeprox

Executive Summary

Jadeprox is an Iran‑linked APT that emerged in April 2026 through a misconfigured Alibaba Cloud staging server. It blends classic spearphishing and public vulnerability exploitation with a custom signed‑binary loader (TriBack Loader) to stealthily establish persistence, DLL sideloading, and encrypted C2 channels across healthcare, government, and education sectors worldwide. Its operations are rapid, multi‑vector, and highly sophisticated, employing cloud infrastructure abuse and cryptomining as evasive techniques while targeting data of strategic or financial value.

Goals & Targeting

Jadeprox seeks to harvest high‑value data from sectors that hold strategic or financial leverage—healthcare records, governmental documents, academic research, and critical infrastructure. While it claims a primary motive of financial gain through mining or ransomware, its operations exhibit characteristics of a state‑aligned APT capable of long‑term espionage. The actor’s strategy is to infiltrate high‑visibility institutions via low‑friction vectors (phishing, CVE exploitation) and embed covert persistence mechanisms that avoid conventional detection. The geographical spread—from Latin America to Southeast Asia—suggests an opportunistic reach into politically vulnerable regions. By exploiting cloud misconfigurations and leveraging legitimate infrastructure (Alibaba Cloud, Cloudflare), Jadeprox minimizes attribution risk while maximizing access opportunities. Ultimately, the actor’s objectives are two‑fold: extract sensitive information and monetize via cryptocurrency mining or potential blackmail, thereby creating financial pressure on targeted entities.

Key Capabilities

• Deploys webshells and staged phishing packages
• Uses signed binary loader (TriBack Loader) for DLL sideloading and shellcode decryption
• Exploits publicly facing vulnerabilities such as SQL injection, buffer overflow, arbitrary command execution
• Harvest credentials through fake portals (tax systems, AI sites)
• Spearfishing attachments (LNK, ZIP+PDF)
• Delivers XOR‑encrypted Windows loader
• Persistence via startup folder autostart & registry Run keys
• DLL sideloading through signed legitimate binaries and masquerading file names
• Obfuscates payloads with nested directories and encrypted files
• Self‑deletes malware using batch scripts
• Deploys custom Go‑based proxy infrastructure behind Alibaba/Cloudflare
• Command and Control over HTTP with internal proxies (iox, suo5, Neo‑reGeorg)
• Installs custom backdoors like BugSleep, StealthCache, Phoenix, Fooder loader
• Uses malicious PowerShell scripts
• Exploits publicly disclosed CVEs in unpatched systems
• Evasion via signed binary proxy execution

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Jadeprox’s first documented engagement in April 2026 leveraged a compromised Alibaba Cloud staging environment to deliver a wide array of malware, including the TriBack Loader and custom backdoors. The actor combines phishing, public vulnerability exploitation, and cloud misconfiguration to gain initial foothold across a broad geographic footprint—Latin America, Southeast Asia, Eastern Europe, and North America. Operational tempo is high: within days of discovery multiple attacks spanned healthcare facilities in Vietnam, diplomatic ministries in Malaysia, educational institutions in Hong Kong, and public bodies in Honduras and Venezuela. Jadeprox uses a custom Go‑based proxy stack behind Cloudflare to obfuscate HTTP C2 traffic and deploys cryptomining as a decoy during idle periods. While no prior campaign of this scale has been documented, the actor’s methodology indicates a learned, mature threat group that blends conventional APT TTPs with opportunistic exploitation of misconfigured cloud infrastructure, thereby enabling rapid expansion into new targets.

IOC Patterns

• Exposed Alibaba Cloud directories without authentication
• Signed malware binaries masquerading as legitimate DLLs (hostfxr.dll, avk.dll)
• Phishing domains impersonating tax or AI services
• Recently registered malicious domains with short TTLs
• CVE exploitation of public web applications (e.g., CVE‑2018‑11511, CVE‑2021‑24139)
• Obfuscated nested paths containing encrypted payloads
• Encrypted/XOR‑encoded binaries and scripts
• Self‑deleting batch scripts
• Masquerading file names to avoid detection
• Use of Go‑based proxies behind Cloudflare

Recommended Actions

• Patch known CVEs promptly (e.g., SQLi, buffer overflow, command execution vulnerabilities)
• Monitor cloud environments for exposed directories and unauthorized configuration changes
• Deploy EDR/UEBA capable of detecting DLL sideloading via signed binaries and anomalous backdoor activity
• Educate users on spearphishing attachments such as LNK, ZIP+PDF, and malicious PDFs
• Block traffic to newly registered or suspicious domains using reputable threat feeds
• Implement email filtering rules and user awareness programs to mitigate phishing attacks
• Audit startup folders and registry Run keys for unauthorized persistence mechanisms
• Detect obfuscated file paths, encrypted payloads, and self‑deleting scripts through sandboxing or behavioral analytics
• Inspect outbound HTTP/S traffic for internal proxy patterns (iox, suo5, Neo‑reGeorg) and encrypted C2 channels
• Harden cloud infrastructure access controls, especially on Alibaba Cloud instances, with least privilege and MFA
• Monitor healthcare, government, education facilities for signs of compromise or anomalous activity

Suggested Tags