Operation Dragon Weave Spins a Web of Espionage Through Microsoft Azure

Operation Dragon Weave targets government officials and citizens in Taiwan and the Czech Republic using spear-phishing emails disguised as legitimate government communications — such as project review notices or appointment notifications. Victims receive a ZIP archive delivering malware through one of two methods: a malicious Windows shortcut (LNK) disguised as a PDF document, or a Rust-based dropper that extracts the required components onto the system. The use of Traditional Chinese filenames and Czech-language decoy documents underscores the campaign's precision targeting. The earliest known sample was uploaded from Taiwan in March 2026.

In the script-based infection chain, a VBScript launches a hidden PowerShell script that decrypts and reconstructs a malicious executable named RuntimeBroker_update.exe while displaying a decoy document to distract the victim. Both infection methods — the LNK path and the Rust dropper path — ultimately execute RuntimeBroker_update.exe, which uses DLL sideloading to load a malicious library called UnityPlayer.dll, also known as RUSTCLOAK. Before running its payload, RUSTCLOAK performs sandbox and analysis-environment detection checks. A developer oversight also exposed a Rust build path and the username dell2 within the malware binary.

RUSTCLOAK decrypts and launches its final payload, AZUREVEIL, using multiple encryption and evasion techniques. AZUREVEIL is a fully featured AdaptixC2 agent supporting file operations, command execution, shell access, network tunneling, and in-memory execution of additional tools including Beacon Object Files (BOFs). These 36 post-exploitation capabilities give the attacker flexibility for espionage, lateral movement, and sustained access within compromised environments.

Rather than traditional command-and-control servers, AZUREVEIL uses Microsoft Azure Blob Storage (note1ggbbhggdwa1[.]blob[.]core[.]windows[.]net) as a dead-drop C2 channel. HTTPS traffic blends the malware's communications with legitimate cloud activity. The implant periodically uploads encrypted beacons, retrieves encrypted commands, and returns encrypted results through the same storage container. Researchers identified a hardcoded Shared Access Signature (SAS) token with broad permissions to the Azure storage account, valid from March 2026 through March 2027 — indicating the infrastructure was deliberately designed to support long-term espionage operations and persistent victim network access.