license[.]claude-pro[.]com

An exposed Alibaba Cloud server has revealed a China-nexus operation that Group-IB tracks as JadeProx. The cluster has targeted government, healthcare, and education organizations across Asia and Latin America with a previously undocumented Windows loader called TriBack Loader. Group-IB found the server in mid-April 2026 in Alibaba Cloud's Singapore region; it was offline by the time the report published on July 23, 2026. Its bash history, phishing packages, post-exploitation tools, and webshell paths laid the operation out: active intrusions against a Vietnamese public hospital's medical imaging system and Malaysia's Ministry of Foreign Affairs, scanning and exploitation follow-up against Hong Kong education infrastructure, and a spear-phishing package addressed to the National Congress of Honduras. The operators reached the hospital's imaging server through webshells planted on an exposed Java management interface. One Loader, Four Builds TriBack Loader appears in four infection chains built around DLL sideloading. Most recovered builds pair a legitimate signed executable with a malicious DLL and an encrypted .dat or .log payload. The DLL reverses the payload bytes, XORs them with a rolling key, and executes the shellcode through Win32 calls that EDR watches less closely than CreateThread. The builds rotate that final call: InitOnceExecuteOnce and a TimerQueue callback in two variants, and EtwpCreateEtwThread, an undocumented thread-creation routine in ntdll, in a third. The signed host binary changed between variants too. The repeated API sequence suggests a custom loader builder, the researchers say. Two variants delivered AdaptixC2, an open-source post-exploitation framework. A Claude-themed variant used DonutLoader to run Beagle, a backdoor Sophos was first to document. The fourth variant's payload is unknown; its encrypted companion file was never recovered. One spear-phishing archive carried a fake beverage-company account statement as the decoy. Another campaign impersonated Anthropic's Claude software from claude-pro[.]com, registered on March 28, 2026, serving a malicious MSI installer that, past a UAC prompt, placed the sideloading chain in the Windows Startup folder for persistence. The Beagle backdoor it delivered reported to license[.]claude-pro[.]com. Sophos, working from the fake site, its hosting infrastructure, and malware samples, found the same reused XOR key in builds going back to February but said a shared key was not enough to conclude one actor. Group-IB, working from the exposed server's contents, groups those builds with the Asian intrusions. It still stops short of naming an established group: tooling moves freely in the China-nexus ecosystem, Group-IB notes, so a match on tools is not a match on operators. The operators also ran Nuclei with critical-severity templates only against a list of 14,653 Hong Kong education-related URLs, surfacing 13 unique vulnerabilities. Those 14,653 URLs are a scan list, and the report does not say how many of the follow-ups succeeded. The report names four CVEs the operators attempted against individual hosts, and The Hacker News confirmed all four against NVD on July 23, 2026: CVE-2018-11511 in ASUSTOR ADM, CVE-2021-24139 in the 10Web Photo Gallery WordPress plugin, CVE-2021-31755 in Tenda AC11 routers, and CVE-2021-32305 in WebSVN. Each carries a CVSS base score of 9.8. The Tenda bug has been on CISA's Known Exploited Vulnerabilities catalog since November 3, 2021, with a federal remediation deadline that expired two weeks later. Detection Starts With the Sideloading Chain Sophos assessed that the fake Claude site was likely part of an active malvertising campaign. If so, the exposure runs well past the ministries and hospitals, out to users searching for a Claude download. Detection works off the file layout, because the filenames and signed hosts change per build. Flag signed vendor binaries running from user-writable, temporary, or Startup directories, especially when an encrypted .dat or .log file sits in the same folder. Look for unexpected copies of hostfxr.dll, avk.dll, or MpClient.dll, plus nested _CL_###### folders and ~del.vbs.bat. Block or investigate the cluster's domains: claude-pro[.]com, license[.]claude-pro[.]com, sylverixstrategy[.]com, gouvvbo[.]top, vertextrust-advisors[.]com, and three security-vendor lookalikes sharing one IP, update-trellix[.]com, update-crowdstrike[.]com and update-sentinelone[.]com. The staging server was 43.106.71[.]28 on port 8000. Both lists come from Group-IB's July 23 report. Group-IB puts internet-facing Java applications first, then any public-facing system carrying an unpatched 9.8-rated flaw, these four included. For all the loader engineering, the scanning half of this operation ran on flaws disclosed in 2018 and 2021. The custom work all sits downstream of the break-in.

A fraudulent imitation of Anthropic's Claude website has been used to distribute a previously undocumented backdoor named Beagle, deployed through a Dynamic Link Library (DLL) sideloading chain that abuses a signed antivirus updater binary. The malicious domain claude-pro[.]com presents a stripped-down imitation of the legitimate Claude interface and offers a fictitious tool called Claude-Pro Relay, served as an approximately 505 MB ZIP archive, according to new analysis by Sophos X-Ops. The researchers assessed that the site is part of an active malvertising campaign and traced the hosting infrastructure to a server set up in March 2026. PlugX-Style Chain Leads to Different Payload The downloaded archive contains an MSI installer that drops three files into the user's startup folder: a signed G DATA antivirus updater renamed NOVupdate.exe, an encrypted data file and a malicious DLL named avk.dll. When the legitimate updater executes, it sideloads the malicious DLL in place of its expected library. The DLL decrypts the data file using a reversed XOR key and runs the resulting shellcode, which loads DonutLoader, an open-source in-memory loader. Donut then deploys the final payload, the Beagle backdoor. Sophos initially suspected a PlugX variant given the combination of a G DATA-signed binary, an avk.dll sideload and an encrypted data file, all of which were linked to PlugX in a February 2026 Lab52 report. The delivery of a different payload led researchers to consider that the threat actor may have retooled an established infection chain or imitated one used by another group. Beagle Capabilities and Linked Samples Beagle is a relatively simple backdoor supporting eight commands covering shell execution, file transfer, directory listing and self-removal. It communicates with its command-and-control server at license[.]claude-pro[.]com over TCP port 443 or UDP port 8080, encrypting traffic with a hardcoded AES key. Sophos identified additional samples on VirusTotal sharing the same XOR key, dating back to February 2026. A March variant swapped the final payload for shellcode tied to AdaptixC2, an open-source red-teaming framework Sophos has previously observed in ransomware attacks. Other related samples used domains masquerading as updates for Trellix, CrowdStrike and SentinelOne. The campaign distributed malware through Cloudflare while hosting C2 infrastructure on Alibaba Cloud, a separation researchers said could complicate takedown efforts and signal a degree of operational continuity rather than a short-lived disposable campaign.

A fake version for the Claude AI website offers a malicious Claude-Pro Relay download that pushes a previously undocumented backdoor for Windows named Beagle. The threat actor advertises Claude-Pro as a "high-performance relay service designed specifically for Claude-Code" developers. The fake website is a simplistic attempt at mimicking the legitimate site for the popular Claude large language model (LLM) and an AI assistant, using similar colors and fonts. However, the facade falls apart when it comes to links, as they are mere redirects to the front page, researchers at cybersecurity company Sophos say in a report today. Users landing on “claude-pro[.]com” that fail to see through the deception can only click on a large download button for the malicious resource, a 505MB archive named 'Claude-Pro-windows-x64.zip' that contains an MSI installer allegedly for the Claude-Pro Relay product. Sophos says that running the binary leads to adding three files to the Startup folder: NOVupdate.exe, NOVupdate.exe.dat, and avk.dll. The campaign was initially discovered by Malwarebytes, whose researchers say that the 'Pro' installer is a trojanized copy of Claude that works as expected but deploys a PlugX malware chain in the background, giving attackers remote access to the system. Looking closer at the campaign, Sophos discovered that the first-stage payload was DonutLoader that fetched "a relatively simple backdoor" the researchers call Beagle, with a limited set of commands: uninstall: uninstalls agent cmd: executes command upload: uploads file download: downloads file mkdir: creates directory rename: renames file ls: lists directory content rm: removes directory It is worth clarifying that the Beagle backdoor is distinct from the Delphi-based Beagle/Bagle worm documented in 2004. According to the researchers, NOVupdate.exe is a signed updater for G Data security solutions that the hacker uses to sideload the malicious avk.dll and the encrypted NOVupdate.exe.dat file. Sophos notes that sideloading the AVK DLL and an encrypted file using a G Data signed executable have been linked to PlugX activity in the past. The role of the DLL is to decrypt and execute in memory the payload inside NOVupdate.exe.dat, which is the open-source in-memory injector DonutLoader. Sophos spotted Donut before, in attacks in 2024 that targeted government organizations in Southeast Asia. In this case, Donut deploys the final payload, the Beagle backdoor, into the system memory to evade detection. The backdoor communicates with the command-and-control (C2) at ‘license[.]claude-pro[.]com’ using TCP over port 443 and/or UDP over port 8080, while a hardcoded AES key protects the exchanges. Sophos notes that the C2 is hosted at 8.217.190[.]58, an IP address that Malwarebytes researchers say is in the range associated with the Alibaba-Cloud service. Further investigation led Sophos to additional samples related to Beagle, which were submitted to VirusTotal between February and April this year, and using the same XOR decryption key for decryption. However, those samples infected machines via different attack chains, including Microsoft Defender binaries, AdaptixC2 shellcode and a decoy PDF, and impersonating update sites from multiple security vendors (e.g., CrowdStrike, SentinelOne, and Trellix). Although Sophos was unable to confidently attribute the campaign to a threat actor, the researchers suggest that the same operators behind PlugX might be experimenting with a new payload. To mitigate this risk, users should ensure they are downloading Claude from the official portal and skip or hide sponsored search results. The presence of ‘NOVupdate’ files on a system is a strong indication of compromise. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report