JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake

Group-IB discovered an exposed Alibaba Cloud staging server revealing a multi-country China‑nexus operation dubbed "JadeProx" that used a custom TriBack Loader (DLL sideloading and Win32 callback APIs) to deploy AdaptixC2 and a novel Beagle backdoor via phishing lures and MSI/LNK installers; the report includes full infection chain analysis, four loader variants, extensive IOCs (domains, IPs, file hashes), victimology (Vietnam, Malaysia, Hong Kong, Honduras, Venezuela), and mitigation recommendations.