New TriBack Loader Evades EDR Using Signed Binaries and Win32 Callback APIs

A new shellcode loader, dubbed “TriBack Loader,” to a China-nexus intrusion cluster tracked as JadeProx, with the malware explicitly engineered to evade modern EDR by abusing signed binaries and uncommon Win32 callback APIs. Across at least four observed variants, the loader underpins simultaneous espionage campaigns in South-East Asia and Latin America, including targeting of a […]

The post New TriBack Loader Evades EDR Using Signed Binaries and Win32 Callback APIs appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.