Malware

TriBack

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

operators left a staging server open with tools, command history, and phishing packages ready... used fake Claude software themes to lure victims into opening staged packages.

T1566.001Spearphishing AttachmentEvidence1

Honduras received a lure styled as a major local beverage company statement sent toward its National Congress... Estado de Cuenta.zip ... Estado de Cuenta.lnk

Execution

3 techniques

T1059.005Visual BasicEvidence1

File Hash (MD5) 0e6d22c2a81d29b1f9d8395d44e19e53 script.vbs

T1129Shared ModulesEvidence1

It decrypts and runs shellcode using everyday Windows callback functions so security tools are less likely to notice the launch.

T1574Hijack Execution FlowEvidence1

trusted programs were twisted to start the next stage quietly.

Persistence

2 techniques

T1547.001Registry Run Keys / Startup FolderEvidence1

Review Startup folder entries

T1547.009Shortcut ModificationEvidence1

File Hash (MD5) 35cdbf8a16da1245d574a0365cb87287 Estado de Cuenta.lnk

Privilege Escalation

3 techniques

T1055Process InjectionEvidence1

It decrypts and runs shellcode using everyday Windows callback functions... A third path used shellcode to run Beagle

T1547.001Registry Run Keys / Startup FolderEvidence1

Review Startup folder entries

T1547.009Shortcut ModificationEvidence1

File Hash (MD5) 35cdbf8a16da1245d574a0365cb87287 Estado de Cuenta.lnk

Stealth

4 techniques

T1036MasqueradingEvidence1

used fake Claude software themes... one posing as a Venezuelan municipal tax system... signed vendor binaries that launch from user writable paths

T1055Process InjectionEvidence1

It decrypts and runs shellcode using everyday Windows callback functions... A third path used shellcode to run Beagle

T1070.004File DeletionEvidence1

watch for a double extension cleanup script... File Name ~del.vbs.bat Self-delete double-extension cleanup artifact

T1574Hijack Execution FlowEvidence1

trusted programs were twisted to start the next stage quietly.

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

Those same logs revealed how the actors served DLL sideloading packages to Windows hosts reached through internal tunnels.

INDICATORS OF COMPROMISE

IOCs tracked for this family

29 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

15 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

14 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app14 days ago

domain●●●●●●●●●●●●View more in app14 days ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

Jul 23, 2026

Hackers’ OPSEC Mistake Exposed a Global Espionage Campaign and Its New TriBack Malware

A newly identified loader used in the JadeProx espionage campaign. It starts via DLL sideloading, decrypts and executes shellcode using Windows callback functions to evade detection, and was observed delivering secondary payloads including AdaptixC2 beacons and the Beagle backdoor.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching29

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

TriBack

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

operators left a staging server open with tools, command history, and phishing packages ready... used fake Claude software themes to lure victims into opening staged packages.

T1566.001Spearphishing AttachmentEvidence1

Honduras received a lure styled as a major local beverage company statement sent toward its National Congress... Estado de Cuenta.zip ... Estado de Cuenta.lnk

Execution

3 techniques

T1059.005Visual BasicEvidence1

File Hash (MD5) 0e6d22c2a81d29b1f9d8395d44e19e53 script.vbs

T1129Shared ModulesEvidence1

It decrypts and runs shellcode using everyday Windows callback functions so security tools are less likely to notice the launch.

T1574Hijack Execution FlowEvidence1

trusted programs were twisted to start the next stage quietly.

Persistence

2 techniques

T1547.001Registry Run Keys / Startup FolderEvidence1

Review Startup folder entries

T1547.009Shortcut ModificationEvidence1

File Hash (MD5) 35cdbf8a16da1245d574a0365cb87287 Estado de Cuenta.lnk

Privilege Escalation

3 techniques

T1055Process InjectionEvidence1

It decrypts and runs shellcode using everyday Windows callback functions... A third path used shellcode to run Beagle

T1547.001Registry Run Keys / Startup FolderEvidence1

Review Startup folder entries

T1547.009Shortcut ModificationEvidence1

File Hash (MD5) 35cdbf8a16da1245d574a0365cb87287 Estado de Cuenta.lnk

Stealth

4 techniques

T1036MasqueradingEvidence1

used fake Claude software themes... one posing as a Venezuelan municipal tax system... signed vendor binaries that launch from user writable paths

T1055Process InjectionEvidence1

It decrypts and runs shellcode using everyday Windows callback functions... A third path used shellcode to run Beagle

T1070.004File DeletionEvidence1

watch for a double extension cleanup script... File Name ~del.vbs.bat Self-delete double-extension cleanup artifact

T1574Hijack Execution FlowEvidence1

trusted programs were twisted to start the next stage quietly.

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

Those same logs revealed how the actors served DLL sideloading packages to Windows hosts reached through internal tunnels.

INDICATORS OF COMPROMISE

IOCs tracked for this family

29 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

15 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

14 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app14 days ago

domain●●●●●●●●●●●●View more in app14 days ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

Jul 23, 2026

Hackers’ OPSEC Mistake Exposed a Global Espionage Campaign and Its New TriBack Malware

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching29

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.