China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks

A China-nexus operation, tracked by Group-IB, dubbed JadeProx, is using a new loader called TriBack Loader to target government, healthcare, and education organizations across Asia and Latin America. The operation leverages a fake Claude website to deliver a spear-phishing campaign and exploits vulnerabilities in vario…