Hackers Deploy AZUREVEIL Adaptix Agent Spearphishing

A new spearphishing campaign has emerged, operating with notable stealth. Its targets include government officials, researchers, and technology workers across the Czech Republic and Taiwan.

Threat researchers traced the operation to a China-linked threat actor, with the earliest known sample surfacing from Taiwan in March 2026.

The campaign, named Operation Dragon Weave, delivers a sophisticated multi-stage attack chain that ultimately drops a powerful remote access tool designed to blend seamlessly into trusted cloud infrastructure.

The attack begins with a ZIP archive delivered via email, containing files carefully engineered to look like legitimate government communications.

File names are written in Traditional Chinese, and one decoy document closely mimics an official appointment notice from the Czech Social Security Administration, complete with a scheduled date and a reference to the official government website.

The level of detail embedded in these lures points strongly to a well-resourced, targeted, and highly deliberate espionage operation against specific regions.

Analysts at Seqrite, the cybersecurity firm that identified and investigated this campaign, noted the use of two separate delivery paths contained within a single archive.

Either path a victim takes, a malicious shortcut file or a Rust-compiled executable, ultimately leads to the very same final payload.

Seqrite said in a report shared with Cyber Security News (CSN) that the attack is structured so that each component quietly passes control to the next without raising any visible alerts on the victim’s screen.

Once the infection chain completes, a Rust-based loader known as RUSTCLOAK takes over and decrypts the final payload through a triple-layer process involving modified RC4, Base64 decoding, and AES-CBC encryption.

RUSTCLOAK also checks whether it is running inside a sandbox environment by comparing the machine name against a hardcoded list of over 100 known analysis system names, exiting silently if a match is found.

The final payload, AZUREVEIL, is a fully functional Adaptix command-and-control agent compiled as a 64-bit DLL.

Rather than communicating with a traditional C2 server, it routes all activity through Microsoft Azure Blob Storage, making its traffic nearly indistinguishable from normal enterprise cloud usage.

Hackers Deploy AZUREVEIL Adaptix C2 Agent

AZUREVEIL uses what researchers call a dead-drop resolver approach, meaning the attacker and the infected system never communicate directly with each other.

Both sides interact with the same Azure storage container, where the attacker places commands as encrypted blobs and collects results from that shared location.

This approach makes network-level detection significantly harder, since all traffic appears as routine Azure cloud activity to security monitoring tools.

The agent supports 36 post-exploitation commands covering file operations, shell execution, process listing, port forwarding, and running Beacon Object Files entirely in memory without touching disk. AZUREVEIL resolves around 87 Windows APIs at runtime using a djb2-based hashing method.

A hardcoded Shared Access Signature token found inside the configuration grants full read, write, and delete access, valid from March 2026 to March 2027, suggesting the attacker planned for extended access.

Multi-Stage Infection Chain and Infrastructure Abuse

The infection runs through four stages, each silently handing control to the next. Stage one uses either a malicious LNK shortcut or a Rust-based dropper. Stage two involves a VBScript and PowerShell chain that decrypts and drops the RuntimeBroker_update.exe binary.

Stage three activates RUSTCLOAK through DLL sideloading using a file called UnityPlayer.dll. Stage four launches AZUREVEIL directly in memory, leaving almost nothing behind on disk for investigators to find.

A notable operational slip was also uncovered during analysis. A Rust build path containing the Windows username “dell2” was left embedded inside the RUSTCLOAK binary as plaintext, which could assist future attribution efforts.

Organizations should monitor outbound HTTPS traffic to blob.core.windows.net for unusual patterns, enforce strict execution policies for PowerShell and VBScript, and disable LNK file execution from within compressed archives.

Deploying endpoint detection tools capable of identifying in-memory code execution is also strongly recommended. Government bodies and research institutions located in geopolitically sensitive regions should apply extra scrutiny to any unexpected file attachments received via email.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.