Reported by 2 outlets

Timeline

1. original reporting

   Operation Dragon Weave — China-Linked Espionage Campaign Targets Czech Republic and Taiwan Using Azure Blob Storage as Dead-Drop C2

   malware.news · 137d ago · May 30th, 2026

   Seqrite Labs uncovered a targeted spear-phishing campaign against officials and citizens in the Czech Republic and Taiwan, attributed with moderate confidence to a China-based threat actor. The campaign uses region-specific lures: a Czech Social Security Administration (ČSSZ) appointment notice and a Traditional Chinese project application review form (計畫申請審查結果通知單). Dual delivery paths — a LNK file triggering a VBS → PowerShell → XOR-decrypted chain, and a Rust-based executable dropper — both converge on DLL sideloading via UnityPlayer.dll to execute a Rust loader (RUSTCLOAK), which decrypts and runs AZUREVEIL, an Adaptix C2 agent with 36 post-exploitation commands and in-memory BOF execution capability.

   Notable C2 tradecraft: The malware communicates via Microsoft Azure Blob Storage with a SAS token valid from March 2026 through March 2027, blending C2 traffic with legitimate cloud traffic. This dead-drop resolver technique makes the C2 channel resilient to infrastructure takedown — similar to the ClearFake blockchain-based C2 reported May 28, but using enterprise cloud storage instead of smart contracts.

   ---

2. update from cyberpress.org

   AZUREVEIL — China-Linked Spearphishing Delivers Adaptix C2 via Azure Blob Storage Dead-Drop — Targets Czech Republic and Taiwan

   cyberpress.org · 133d ago · June 3rd, 2026

   The infection chain delivers AZUREVEIL, a heavily modified Adaptix C2 agent with 36 post-exploitation commands, via a RUSTCLOAK loader that bypasses thread creation entirely using Windows fibers. No direct C2 server — encrypted beacons and commands are exchanged through shared Azure containers, blending traffic with legitimate enterprise cloud activity. This mirrors the June 2 reported Operation Dragon Weave but with a refined fiber-based injection technique.