Leaky Alibaba Cloud Server Exposes China-Linked Spying Kit Aimed at Hospitals and Governments
Researchers at Group-IB stumbled on a misconfigured server in Singapore that revealed a new Windows loader, TriBack, used against targets across Asia and Latin America.
Key points
- Group-IB found an exposed Alibaba Cloud server in the Singapore region in mid-April 2026 tied to a China-linked spying operation it calls JadeProx.
- The server held a previously unknown Windows loader named TriBack Loader, used to smuggle spying tools onto victim machines.
- Targets included government bodies, hospitals, and universities across Asia and Latin America.
- The server had gone offline by the time Group-IB published its findings.
- No public evidence yet links the campaign to a named Chinese state group, and no CVE is involved: this is a spying operation, not a single software flaw.
A Chinese spying crew left the lights on.
Security company Group-IB says it spotted a misconfigured server on Alibaba Cloud, the Chinese equivalent of Amazon's cloud service, in mid-April 2026. The server was hosted in Singapore. Inside, researchers found the working files of a hacking group they now track as JadeProx.
The group had been quietly breaking into government offices and hospitals across Asia and Latin America. That detail matters, because the victims are places most of us actually deal with: the office that issues your ID, the clinic that holds your medical notes.
Who are JadeProx and what were they doing?
JadeProx is the name Group-IB gives to a hacking cluster it links to China. The crew's job appears to be espionage, meaning stealing information rather than demanding a ransom. On the exposed server, researchers found a brand-new tool they've named TriBack Loader.
A loader is the quiet first stage of an attack: it slips onto a Windows computer, checks that no security software is watching, and then pulls down the real spying tool. TriBack Loader hadn't been documented anywhere before this find. Group-IB's own timeline suggests the operators had been running it for some time before their server faced the open internet.
Group-IB had caught our attention once before on this beat: our 20 July report on HollowGraph covered a separate espionage tool the firm linked to Iran-nexus activity, and the same discipline of leaving operational infrastructure exposed shows up in both cases.
Who was targeted?
Government, healthcare, and education organisations across Asia and Latin America, according to Group-IB. The report doesn't name individual victims, which is normal for an active investigation.
| Detail | What Group-IB found |
|---|---|
| Server discovered | Mid-April 2026 |
| Hosting provider | Alibaba Cloud, Singapore region |
| Tool exposed | TriBack Loader (new Windows loader) |
| Sectors hit | Government, healthcare, education |
| Regions | Asia and Latin America |
| Status now | Server offline at time of reporting |
Should ordinary people be worried?
Not directly, but the indirect risk is real. Spying groups like this one usually want documents and email, not your bank card. The risk to you comes from what they take from the public bodies that hold your data.
If you live in one of the affected regions and receive a notice about a data incident from a hospital or ministry in the coming months, take it seriously. Watch for unusually well-informed phishing emails, fake messages that use real personal details to trick you into clicking a link or handing over a password. That's often how stolen government and healthcare data gets reused.
What about the identity angle?
Loaders like TriBack typically arrive after a stolen credential, a booby-trapped document, or a foothold on a contractor's machine. This is the boring truth of most state-linked intrusions: the fancy custom tool lands after someone reused a password or approved a login prompt they shouldn't have.
Phishing-resistant MFA, meaning hardware keys or passkeys as defined in the WebAuthn standard, wouldn't stop a malicious document opened on a workstation. It would, however, block the credential theft that lets these crews walk in through a webmail portal or a VPN (a remote-access gateway staff use from home). On the balance of what reports like this typically show, that kind of authentication would meaningfully raise the bar for JadeProx's next campaign. The China-linked university intrusions we reported on 8 July followed almost the same playbook, targeting login portals rather than patching gaps.
Group-IB says the server is now dark. The people behind it almost certainly aren't.
