China-Aligned Groups Ramp Up Attacks: Dragon Weave Hits Czech Republic & Taiwan
Summary: Seqrite Labs documented Operation Dragon Weave, a China-aligned espionage campaign using spear-phishing ZIP attachments to deliver an AdaptixC2 agent called AZUREVEIL to government, research, academic, technology, and financial targets in the Czech Republic and Taiwan. The chain runs through a malicious LNK posing as a PDF or a Rust-based dropper, then DLL side-loading of UnityPlayer.dll to deploy the RUSTCLOAK loader, which decrypts the payload and communicates through Azure Blob Storage in a dead-drop model rather than direct C2.
What's compelling: AZUREVEIL's traffic goes to Azure Blob Storage, the same service thousands of legitimate enterprises use, and its 36 commands include shell execution, port forwarding, SOCKS proxy control, and in-memory BOF execution - full control of the endpoint over a channel that looks like ordinary cloud storage use.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026