Group-IBPublished
JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake
By Sathwik Ram Prakki
Excerpt
Introduction
In mid-April 2026, an exposed directory on an operator-owned Alibaba Cloud server gave us a complete view into an active China-nexus operation. The server with bash history, toolkits, webshell paths against victims, and staged phishing packages were all visible. The investigation uncovered simultaneous intrusions against a Vietnamese public hospital’s medical imaging system, the Malaysian Ministry of Foreign Affairs, and multiple Hong Kong educational institutions. Running in parallel, similar targeting of Honduras and phishing campaigns themed around fake…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Group-IB on group-ib.com.
Mentioned in the excerpt
More from Group-IB28
- Stray Cat, Open Doors: How k0t Wanders Through the Network EdgeGroup-IB · Published 21 Oct
- BlogGroup-IB · Published 15 Dec 2022
- Anatomy of BraZetsu: How Cybercriminals Fuel the Underground EcosystemGroup-IB · Published 31 Aug
- The GHOST STADIUM Score: Billions At Stake At The World’s Largest Football TournamentGroup-IB · Added 4 Jun
On the same topics
- MoqHao Part 1: Identifying Phishing InfrastructureTeam Cymru · Published 10 Jan 2021
- LARVA-208PRODAFT · Added 18 Oct
- Why Are You Texting Me? UNC3944 Leverages SMS Phishing Campaigns for SIM Swapping, Ransomware, Extortion, and NotorietyMandiant (Google) · Published 14 Sep 2023
- App-Specific Password phishing and how to prevent itpushsecurity.com · Published 26 Jun 2025
