China-Linked JadeProx Exploits Old CVEs and Phishing to Hit Government and Healthcare
The JadeProx operation succeeded partly because organizations were still exposed to vulnerabilities dating back to 2018 and 2021, demonstrating that unpatched legacy flaws remain a reliable entry point for advanced threat actors. Attackers combined this with phishing campaigns impersonating trusted AI software (Claude/Anthropic) to lower user defenses and gain initial access. Once inside, the TriBack Loader's use of DLL sideloading with rotating Windows APIs allowed it to evade modern EDR solutions, highlighting how sophisticated loaders can render endpoint controls ineffective when underlying hygiene is poor. The exposure of an Alibaba Cloud server by the attackers themselves also underscores that operational security failures can cut both ways — but defenders cannot rely on adversary mistakes to protect critical infrastructure.
Tactical Insight
Immediate actions
- Patch CVE-2021-31755 and CVE-2018-11511 immediately on all affected internet-facing systems, prioritizing government and healthcare assets.
- Audit and harden cloud storage configurations (e.g., Alibaba Cloud, AWS S3) to eliminate publicly exposed buckets or misconfigured servers.
- Deploy phishing-resistant MFA across all user accounts, especially for email and remote access portals.
Detection measures
- Enable behavioral detection rules in your EDR/SIEM for DLL sideloading patterns and suspicious use of Windows APIs such as InitOnceExecuteOnce, TimerQueue, and EtwpCreateEtwThread.
- Implement DNS and network monitoring to flag C2 communication patterns associated with AdaptixC2 and Beagle backdoor indicators of compromise.
- Ingest and correlate threat intelligence feeds referencing JadeProx/TriBack TTPs mapped to MITRE ATT&CK to proactively hunt for intrusion artifacts.
Long-term improvements
- Establish a formal vulnerability management program with SLA-based patching timelines (e.g., critical CVEs patched within 15 days) enforced across all asset classes.
- Conduct regular security awareness training that includes AI software impersonation scenarios to reduce phishing susceptibility among staff.
- Implement network segmentation to isolate government and healthcare systems, limiting lateral movement opportunities if initial access is achieved.