China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks

**Executive summary:** Group-IB exposed an Alibaba Cloud server revealing a China-nexus operation (tracked as JadeProx) that used a new Windows loader called TriBack Loader and multiple DLL sideloading builds to deliver post-exploitation tools and backdoors against government, healthcare, and education organizations across Asia and Latin America; the report includes detailed TTPs (phishing, malvertising, large-scale Nuclei scanning), high-severity CVEs targeted, and observable IOCs (domains, IP 43.106.71.28:8000, file patterns) for detection and blocking.