Critical Adaptix Flaw Lets Attackers Deploy AZUREVEIL C2 Agent

Key Takeaways

• A new, stealthy spearphishing campaign, “Operation Dragon Weave,” is targeting government officials, researchers, and tech workers in the Czech Republic and Taiwan.
• The campaign, attributed to a China-linked threat actor, utilizes a multi-stage infection chain to deploy the AZUREVEIL Adaptix C2 agent.
• AZUREVEIL employs Microsoft Azure Blob Storage for command-and-control communications, making detection challenging as traffic blends with legitimate cloud activity.
• The attack chain involves carefully crafted lures, a Rust-based loader (RUSTCLOAK) that evades sandboxes, and in-memory execution of the final payload.
• Defenders should enhance email security, monitor Azure Blob Storage traffic for anomalies, and implement robust endpoint detection to counter advanced in-memory threats.

Sophisticated Spearphishing Campaign Targets Eastern Europe and Asia

A highly sophisticated and stealthy spearphishing campaign, dubbed “Operation Dragon Weave,” has been uncovered, primarily targeting high-value individuals such as government officials, academic researchers, and technology sector employees within the Czech Republic and Taiwan. This operation, active since at least March 2026, has been linked by threat researchers to a state-sponsored actor originating from China.

The campaign distinguishes itself through a multi-stage attack methodology that culminates in the deployment of a potent remote access tool. This tool, known as AZUREVEIL, is designed to camouflage its command-and-control (C2) communications within legitimate cloud infrastructure, specifically Microsoft Azure.

Initial Infection Vector and Deceptive Lures

The attack sequence commences with a spearphishing email delivering a ZIP archive. This archive contains meticulously crafted files engineered to mimic official government correspondence. The file names are presented in Traditional Chinese, and one particular decoy document convincingly impersonates an official appointment notice from the Czech Social Security Administration. This fake notice includes specific dates and references to official government websites, indicating a high level of reconnaissance and targeting precision.

Analysts at Seqrite, the cybersecurity firm responsible for uncovering and detailing this campaign, emphasized that the intricate detail within these lures strongly suggests a well-resourced, highly targeted, and deliberate espionage operation focused on specific geopolitical regions. The campaign’s design features two distinct delivery paths within the initial archive—either a malicious shortcut file or a Rust-compiled executable—both of which ultimately lead to the same final malicious payload. According to a report by Seqrite, the attack chain is engineered so that each component silently transitions control to the next, avoiding any visible alerts on the victim’s system.

AZUREVEIL: A Cloud-Native C2 Agent

Upon successful execution of the infection chain, a Rust-based loader named RUSTCLOAK takes control. RUSTCLOAK is responsible for decrypting the final payload through a complex, triple-layered process involving modified RC4, Base64 decoding, and AES-CBC encryption. A key feature of RUSTCLOAK is its anti-analysis capability; it performs checks against a hardcoded list of over 100 known sandbox and analysis system names, exiting silently if a match is found to evade detection.

The ultimate payload, AZUREVEIL, functions as a full-featured Adaptix command-and-control agent, compiled as a 64-bit DLL. Its operational sophistication lies in its C2 communication strategy. Instead of connecting to conventional C2 servers, AZUREVEIL routes all its activities through Microsoft Azure Blob Storage. This method renders its network traffic nearly indistinguishable from ordinary enterprise cloud usage, making it exceptionally difficult for traditional security monitoring tools to detect.

Stealthy Communication and Advanced Capabilities

AZUREVEIL employs a “dead-drop resolver” mechanism for its C2 operations. This means that the attackers and the compromised system never establish a direct connection. Instead, both parties interact with the same Azure storage container. Attackers upload encrypted commands as blobs, and the infected system retrieves these commands and deposits the results back into the shared storage. This indirect communication significantly complicates network-level detection, as all observed traffic appears as routine Azure cloud activity.

The agent boasts extensive post-exploitation capabilities, supporting 36 commands that encompass file system operations, shell command execution, process enumeration, port forwarding, and the ability to execute Beacon Object Files (BOFs) entirely in memory, leaving minimal forensic artifacts on disk. AZUREVEIL dynamically resolves approximately 87 Windows APIs at runtime using a djb2-based hashing method. Analysis revealed a hardcoded Shared Access Signature (SAS) token within the agent’s configuration, granting full read, write, and delete permissions. This token’s validity, from March 2026 to March 2027, suggests the attackers planned for prolonged access to compromised systems.

Multi-Stage Infection Chain and Operational Security Lapse

The infection process is a meticulously orchestrated four-stage chain, with each stage silently passing control to the next.

1. Stage One: Initiated by either a malicious LNK shortcut or a Rust-based dropper delivered via the spearphishing email.
2. Stage Two: Involves a VBScript and PowerShell execution chain that decrypts and drops the RuntimeBroker_update.exe binary.
3. Stage Three: Activates RUSTCLOAK through DLL sideloading, utilizing a malicious file named UnityPlayer.dll.
4. Stage Four: Launches AZUREVEIL directly into memory, minimizing its footprint on the disk and complicating forensic analysis.

During their analysis, researchers also identified a notable operational security oversight. The RUSTCLOAK binary contained a plaintext Rust build path that included the Windows username “dell2.” This detail could potentially aid in future attribution efforts against the threat actor.

What You Should Do

• Enhance Email Security: Implement advanced email filtering solutions that can detect and block spearphishing attempts, especially those containing suspicious ZIP archives or unusual file types.
• Monitor Azure Blob Storage Traffic: Actively monitor outbound HTTPS traffic to blob.core.windows.net for any anomalous patterns, unusual data volumes, or unexpected access from internal systems.
• Enforce Strict Execution Policies: Implement and enforce strict execution policies for PowerShell and VBScript within your environment. Consider disabling LNK file execution from within compressed archives.
• Deploy Advanced Endpoint Detection: Utilize Endpoint Detection and Response (EDR) solutions capable of identifying and preventing in-memory code execution and DLL sideloading techniques.
• Employee Training: Conduct regular cybersecurity awareness training for all employees, particularly those in government, research, and technology sectors, focusing on recognizing sophisticated spearphishing lures.
• Geopolitical Scrutiny: Organizations in geopolitically sensitive regions should exercise heightened vigilance and apply extra scrutiny to all unexpected file attachments received via email.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.