Full Report
A China-linked espionage operation compromised a Vietnamese public hospital’s X-ray and MRI imaging system, tunneled through Malaysia’s Ministry of Foreign Affairs network, and sent malware to Honduras’s National Congress — all using a custom Windows loader that none of the major endpoint security vendors had previously documented, according to Group-IB’s full technical breakdown published on July 23,…
Analysis Summary
# Threat Actor: JadeProx
## Attribution & Identity
- **Actor Name:** JadeProx
- **Attribution:** China-nexus (linked to Chinese state-sponsored espionage).
- **Known Associations:** Operationally linked to campaigns utilizing the "TriBack Loader."
## Activity Summary
JadeProx is a recently identified espionage group (active through mid-2026) that conducts sophisticated cross-border operations. The group recently compromised a Vietnamese public hospital's imaging systems and successfully tunneled through the Malaysian Ministry of Foreign Affairs to target the National Congress of Honduras. Simultaneously, the group engaged in a malvertising/phishing campaign targeting the general public by impersonating AI software providers.
## Tactics, Techniques & Procedures
- **Evasion (Windows Callback Abuse):** The actor utilizes a custom loader that cycles through four distinct Windows callback APIs. This technique is specifically designed to bypass EDR (Endpoint Detection and Response) tools, as these APIs are less frequently instrumented than standard thread-creation calls.
- **Phishing & Malvertising:** Setting up fraudulent websites to distribute malware under the guise of legitimate software.
- **Network Tunneling:** Leveraging compromised government infrastructure (Malaysia) to pivot and attack secondary targets (Honduras).
- **OPSEC Failures:** The group was identified partly due to a failure to disable directory listings on their command-and-control (C2) server.
**Associated MITRE ATT&CK Techniques (Inferred):**
- **T1055:** Process Injection (via callback APIs)
- **T1566.002:** Phishing: Spearphishing Link / Malvertising
- **T1090:** Proxy (Tunneling through compromised government networks)
- **T1583.003:** Acquire Infrastructure: Virtual Private Server
## Targeting
- **Sectors:** Healthcare, Government/Foreign Affairs, Legislative bodies, Technology users.
- **Geography:** Vietnam, Malaysia, Honduras, and global (via malvertising).
- **Victims:**
- Vietnamese Public Hospital (X-ray and MRI imaging systems).
- Malaysia Ministry of Foreign Affairs.
- Honduras National Congress.
- Users of Claude AI (potential victims via malvertising).
## Tools & Infrastructure
- **Malware Families:**
- **TriBack Loader:** A custom Windows loader designed for EDR evasion.
- **Infrastructure (Defanged):**
- `claude-pro[.]com` (Phishing domain registered March 2026).
- Unspecified C2 server with exposed directory listing.
## Implications
JadeProx demonstrates a high level of persistence and the ability to pivot between vastly different sectors (healthcare to high-level diplomacy). Their use of undocumented Windows callback APIs suggests a sophisticated understanding of internal OS mechanics and a focus on circumventing modern security stacks. The use of "stepping stone" attacks (using one country's ministry to attack another's congress) complicates attribution and international incident response.
## Mitigations
- **Enhance EDR Monitoring:** Configure endpoint security tools to monitor for unusual callback API executions, specifically focusing on those outside of common thread-creation patterns.
- **Network Segmentation:** Isolate critical medical IoT (X-ray/MRI units) from the broader corporate and guest networks.
- **Web Filtering:** Block recently registered domains and those mimicking popular AI services (e.g., Anthropic, OpenAI).
- **Cross-Border Monitoring:** Government agencies should implement strict egress filtering and monitor for unauthorized tunneling or proxying behavior targeting foreign government IP ranges.