AZUREVEIL Malware Campaign Uses Azure Blob Storage to Hide Adaptix C2 Traffic

A China-linked espionage campaign is using spearphishing emails to deliver AZUREVEIL, a malware payload based on the AdaptixC2 agent. The campaign targets the Czech Republic and Taiwan and uses Microsoft Azure Blob Storage to make command-and-control traffic look like normal cloud activity.

The operation, tracked as Operation Dragon Weave by Seqrite researchers, starts with a ZIP archive that contains files disguised as official documents. Once opened, the archive can launch a multi-stage infection chain that drops a Rust-based loader and then executes AZUREVEIL in memory.

Seqrite said the campaign focuses on the Czech Republic and Taiwan, with affected sectors including government, public sector, research, academia, technology, software, and financial services. The earliest known sample was submitted from Taiwan on March 26, 2026.

Operation Dragon Weave uses fake official documents

The phishing lure uses Traditional Chinese file names and document themes that appear to mimic official communications. In one case, the decoy document looked like an appointment notice from the Czech Social Security Administration.

The delivery method matches the MITRE ATT&CK spearphishing attachment technique, where attackers send malicious files to targeted users. This campaign uses that initial access method to move victims into a hidden script and loader chain.

The ZIP archive contains two possible execution paths. One path uses a malicious Windows shortcut file that looks like a PDF. The other uses a Rust-compiled executable that acts as a self-contained dropper. Both paths eventually reach the same payload.

Campaign detail	Information
Campaign name	Operation Dragon Weave
Final payload	AZUREVEIL AdaptixC2 agent
Target regions	Czech Republic and Taiwan
Initial delivery	ZIP archive with malicious LNK and executable files
Command-and-control channel	Microsoft Azure Blob Storage
Attribution	China-linked threat actor, moderate confidence

RUSTCLOAK loads AZUREVEIL in memory

After the first stage runs, the attack uses a VBScript and PowerShell chain to decrypt and execute RuntimeBroker_update.exe. That file then sideloads a malicious UnityPlayer.dll, which Seqrite tracks as RUSTCLOAK.

RUSTCLOAK performs several checks before launching the final payload. It compares the infected computer’s name against a hardcoded list of more than 100 sandbox and analyst machine names. If it finds a match, it exits without running the malware.

The loader then decrypts the payload through several layers. Seqrite reported a modified RC4 stage, Base64 decoding, and SM4-CBC decryption before the final AZUREVEIL payload runs in memory.

• The victim opens a ZIP attachment from a spearphishing email.
• A fake PDF shortcut or Rust executable starts the infection chain.
• VBScript and PowerShell prepare the next payload.
• RuntimeBroker_update.exe sideloads a malicious UnityPlayer.dll.
• RUSTCLOAK decrypts and runs AZUREVEIL in memory.

AZUREVEIL hides inside trusted cloud traffic

AZUREVEIL is a 64-bit DLL based on AdaptixC2, an open-source post-exploitation framework used for authorized security testing. Threat actors often abuse legitimate red-team tools because they provide ready-made capabilities for remote control, command execution, and post-compromise activity.

Instead of calling a traditional attacker-controlled C2 server, AZUREVEIL uses Azure Blob Storage as a shared communication channel. Microsoft describes Blob Storage as cloud object storage for large amounts of unstructured data, which makes it common in enterprise environments.

This approach resembles a dead drop resolver technique. The infected machine and the attacker do not need to talk directly. Instead, both sides use the same cloud storage location to exchange encrypted commands and results.

Why Azure Blob Storage makes detection harder

Cloud-based C2 can make network monitoring more difficult because traffic to blob.core.windows.net may look normal inside companies that already use Microsoft cloud services. Blocking the entire service can break legitimate business applications.

The malware used a hardcoded shared access signature token to interact with the Azure storage container. Microsoft says SAS tokens can delegate access to Azure Storage resources with specific permissions and time limits.

Seqrite found that the token was valid from March 19, 2026, to March 19, 2027. It granted broad access, including read, write, delete, and upload permissions, suggesting the attackers planned for long-term use of the infrastructure.

Technical component	Role in the attack
Malicious ZIP archive	Initial delivery container
LNK file	Starts the script-based path
Profile.ps1	Decrypts and launches the next stage
RuntimeBroker_update.exe	Legitimate-looking sideloading executable
UnityPlayer.dll	Malicious RUSTCLOAK loader
Com.dat	Encrypted AZUREVEIL payload container

AZUREVEIL supports 36 post-exploitation commands

Seqrite’s analysis found that AZUREVEIL can run 36 commands after infection. These commands cover file operations, shell execution, process listing, network pivoting, SOCKS proxy control, port forwarding, and in-memory Beacon Object File execution.

The AdaptixC2 framework is designed for post-exploitation and adversarial emulation, but AZUREVEIL shows how attackers can repurpose this kind of tooling for covert access. The malware also resolves around 87 Windows APIs at runtime using a djb2-based hashing method.

In-memory execution raises the risk for defenders because the malware can run additional code without dropping many new files to disk. That reduces the evidence available to traditional file-based antivirus tools and makes endpoint behavior monitoring more important.

Indicators defenders should watch

Organizations in government, research, technology, and finance should treat unexpected ZIP attachments with extra caution, especially when they include shortcut files, script files, or executables disguised as documents.

Security teams should monitor unusual HTTPS activity to Azure Blob Storage, especially when endpoints that do not normally use Azure begin making regular connections to blob.core.windows.net. Monitoring should focus on behavior, frequency, destination patterns, and the process responsible for the traffic.

Teams should also review any exposed SAS tokens. Long-lived tokens with broad permissions create risk if attackers steal or hardcode them inside malware.

Type	Indicator	Description
Network	note1ggbbhggdwa1[.]blob[.]core[.]windows[.]net	Azure Blob Storage C2 endpoint
SHA-256	096372d19b4787e989f44e04c5ecc29885aa927c34ae8666628d6c0eb20bb447	Malicious LNK file
SHA-256	1c56228cbd1bdebb9e5ea55c2749150fee06c865ede4a3754e8bd6843e51d2d4	Executable dropper
SHA-256	080ab9bc2893ba7bad354551604a667af40ed2ae2d042d2323c2bd9ad3122192	UnityPlayer.dll RUSTCLOAK loader
SHA-256	61f7d9cd2d8ce7df950639b23ce90085b300b0c6dd0d8d934bba8fdecb670f15	RuntimeBroker_update.exe
SHA-256	24aa4e780ccd66cef13da9ef98c32954105cf2a32ec643efab0ba1aa2d6352f4	Com.dat encrypted payload container

How organizations can reduce risk

Operation Dragon Weave shows why defenders need to inspect both email attachments and cloud service traffic. A campaign can begin with a familiar phishing technique, then hide its later activity inside a service that many organizations already trust.

Defenders should map this campaign against the spearphishing attachment technique and use attachment sandboxing, file extension controls, and user reporting workflows to catch the earliest stage. LNK files inside compressed archives deserve special scrutiny.

Security teams should also hunt for patterns linked to the dead drop resolver technique, including unusual cloud storage access from non-browser processes. Endpoint tools should detect hidden PowerShell execution, DLL sideloading, in-memory payload execution, and suspicious named pipe behavior.

• Block or warn on LNK files inside ZIP archives.
• Restrict PowerShell and VBScript execution where possible.
• Monitor unusual outbound HTTPS traffic to blob.core.windows.net.
• Review long-lived Azure SAS tokens and reduce token permissions.
• Use endpoint tools that detect DLL sideloading and in-memory execution.
• Train high-risk users to report unexpected government-themed attachments.

FAQ