China-Nexus Hackers Target Hospitals and Governments with TriBack Loader Malware

A Group-IB discovery revealed a China-linked espionage campaign that deployed a new loader, TriBack Loader, to infiltrate a Vietnamese public hospital's imaging systems and multiple government entities across South-East Asia and Latin America. The attackers used DLL sideloading and Windows callback API targeting to evade endpoint security, ran phishing campaigns impersonating Anthropic's Claude AI, and left an exposed command server containing tools and scripts (including a modified fuckaliyun.sh) that detailed victim lists and operational tactics.