JadeProx spies on Asian, Latin American hospitals and ministries

The article details a cybersecurity report on the JadeProx cluster, linked to espionage-type intrusions targeting various entities in Asia and Latin America, including a Vietnamese public hospital and Malaysia's foreign ministry. The report by Group-IB reveals that operators used a custom TriBack Loader for credential harvesting and phishing attacks. Key points include:

• **Actor**: JadeProx, attributed to a China-nexus.
• **Activity**: Espionage, phishing, credential harvesting.
• **Targets**: Public institutions in Vietnam, Malaysia, Hong Kong, Honduras, and Venezuela.
• **Scale**: Included over 14,000 URLs in target lists, indicating significant operational breadth.
• **Tactics**: Utilized open servers and old vulnerabilities; included a phishing site mimicking Anthropic’s AI software.
• **Tools**: Exploited vulnerabilities (e.g., CVE-2018-11511) and used legitimate binaries for malicious DLL sideloading.
• **Impact**: Focused on long-term espionage rather than immediate financial gain.
• **Next Steps for Protection**: Recommendations include auditing interfaces, patching vulnerabilities, and monitoring for unusual downloads.