Seqrite tracked Operation Dragon Weave, a spearphishing campaign targeting officials and citizens in the Czech Republic and Taiwan with lure documents, ZIP attachments, and a multi-stage infection chain leading to AZUREVEIL. The final payload is an Adaptix C2 agent that abuses Microsoft Azure Blob Storage for dead-drop command-and-control, and the campaign is assessed to be linked with moderate confidence to a China-based threat actor. #OperationDragonWeave #AZUREVEIL #Adaptix #MicrosoftAzureBlobStorage #CzechRepublic #Taiwan
Keypoints
- The campaign targeted government and public sector, research and academia, technology and software, and financial services organizations.
- Victims were primarily in the Czech Republic and Taiwan, using region-specific lure documents written in Traditional Chinese and Czech.
- The infection began with a ZIP archive containing a malicious LNK or a Rust-compiled executable, both leading to the same payload chain.
- Path A used empty.vbs and Profile.ps1 to decrypt 1.dat and drop RuntimeBroker_update.exe; Path B extracted the components directly from the executable.
- RuntimeBroker_update.exe sideloaded a malicious UnityPlayer.dll, which loaded the Rust-based loader RUSTCLOAK.
- RUSTCLOAK used sandbox checks and multi-layer decryption before loading AZUREVEIL in memory.
- AZUREVEIL is an Adaptix C2 agent that communicates through Microsoft Azure Blob Storage, supports 36 commands, and can exfiltrate data and execute BOFs in memory.
MITRE Techniques
- [T1566.001] Spearphishing Attachment – The campaign began with a ZIP attachment used to deliver malicious files and lure documents (‘spearphishing campaign targeting officials and citizens’).
- [T1204.002] Malicious File – User Execution – The infection required the victim to click the LNK or run the executable to start the chain (‘depending on which file the victim interacted with first’).
- [T1059.001] PowerShell – Profile.ps1 was launched through PowerShell to decrypt and drop the next-stage executable (‘launch Profile.ps1 using PowerShell’).
- [T1059.005] Visual Basic – empty.vbs acted as a small VBScript bridge to start the PowerShell stage (‘a very small VBScript with a single purpose’).
- [T1574.002] DLL Side-Loading – RuntimeBroker_update.exe loaded malicious UnityPlayer.dll from the same folder instead of the legitimate DLL (‘Windows loads the attacker’s DLL instead of the legitimate one’).
- [T1027] Obfuscated Files or Information – The campaign used XOR, RC4, Base64, and SM4 layers to hide payloads (‘multi-layer encryption used to protect the payload’).
- [T1497.001] Virtualization/Sandbox Evasion – RUSTCLOAK checked machine names against a list of sandbox and analyst systems before proceeding (‘checks whether it is running in a sandbox’).
- [T1083] File and Directory Discovery – AZUREVEIL can list directory contents and logical drives (‘List directory contents and logical drives’).
- [T1057] Process Discovery – AZUREVEIL can list running processes and named pipes (‘List running processes and named pipes’).
- [T1016] System Network Configuration Discovery – AZUREVEIL can enumerate network adapters and related details (‘Network adapter enumeration (MAC, IP, type)’).
- [T1082] System Information Discovery – The agent can retrieve system uptime and other host details (‘Retrieve system uptime’).
- [T1102.001] Web Service – Dead Drop Resolver – AZUREVEIL used Azure Blob Storage as a dead-drop C2 channel instead of a direct server (‘both sides use the same Azure storage container’).
- [T1573] Encrypted Channel – The agent exchanged encrypted beacons, commands, and results over HTTPS (‘uploads a small encrypted beacon’).
- [T1090] Proxy – The agent supported SOCKS proxy and port forwarding for pivoting (‘Port forwarding and SOCKS proxy control’).
- [T1105] Ingress Tool Transfer – The agent could drop files from C2 and queue file downloads to the victim (‘Drop files from C2 to the victim system’).
- [T1041] Exfiltration Over C2 Channel – Files and execution results were uploaded back through Azure Blob Storage (‘uploads the results back as encrypted blobs’).
- [T1055] Process Injection – The report maps this behavior to process injection in its MITRE mapping (‘Process injection’).
- [T1620] Reflective Code Loading – The in-memory loading of the final payload and BOF execution aligns with reflective loading behavior (‘loads a full executable in memory’).
Indicators of Compromise
- [Domains] Azure Blob Storage C2 infrastructure – note1ggbbhggdwa1[.]blob[.]core[.]windows[.]net
- [File names] Initial delivery and payload chain – 計畫申請審查結果通知單.pdf.lnk, _計畫申請審查結果通知單.exe
- [File names] Dropper and loader components – RuntimeBroker_update.exe, UnityPlayer.dll, BrowserViewUtility.exe
- [File names] Script and encrypted data files – empty.vbs, Profile.ps1, 1.dat, Com.dat
- [File names] Lure documents and decoy content – 000b67d70f3876965bb09fd37164b7ccrezervaci.pdf, 000b67d70f3876965bb09fd37164b7.pdf
- [SHA-256 hashes] Referenced samples and artifacts – 096372d19b4787e989f44e04c5ecc29885aa927c34ae8666628d6c0eb20bb447, 1c56228cbd1bdebb9e5ea55c2749150fee06c865ede4a3754e8bd6843e51d2d4, and 10 more hashes
- [SAS token] Azure storage authentication token embedded in encrypted_blob – sv=2024-11-04&ss=b&srt=sco&sp=rwdlaciytfx&st=2026-03-19T09:20:44Z&se=2027-03-19T17:35:44Z&spr=https&sig=ECJjJIIE9Ou75dwiHhliC4fWccdBpLX9u580AX9TGwY=
- [Computer names] Sandbox/analysis evasion targets checked by RUSTCLOAK – DESKTOP-NAKFFMT, JULIA-PC, and ARCHIBALD-PC