New TriBack Loader Evades EDR Using Signed Binaries and Win32 Callback APIs

TriBack Loader is a custom shellcode loader used by the JadeProx cluster to conduct espionage across SEA and LATAM, employing DLL sideloading with signed binaries and uncommon Win32 callback APIs (e.g., InitOnceExecuteOnce, TimerQueue callbacks, EtwpCreateEtwThread) to evade EDR; investigators recovered an exposed Alibaba Cloud staging server containing post-exploitation toolkits, phishing lures, beacon configurations (AdaptixC2), Donut-based reflective loaders (Beagle backdoor), and multiple C2 domains and IOCs for defenders to hunt.