China-Aligned Campaigns Target Czech Republic and Taiwan With AdaptixC2 and Other Tools
Summary
Operation Dragon Weave uses spear-phishing ZIPs and a Rust-based chain to deliver AdaptixC2 against targets in the Czech Republic and Taiwan. The article also details TencShell activity and other China-aligned campaigns and toolkits.
Key points
- Operation Dragon Weave targets officials and citizens in the Czech Republic and Taiwan, with spear-phishing ZIP attachments used to initiate infection.
- One infection path uses a disguised LNK file, PowerShell, and an intermediate DAT file; another launches a Rust-based dropper directly.
- Both paths load a malicious DLL through side-loading, leading to the RUSTCLOAK loader and an AdaptixC2 agent called AZUREVEIL.
- AZUREVEIL uses Azure Blob Storage as a dead-drop C2 channel and supports 36 commands, including file operations, shell execution, proxying, and in-memory execution.
- Cato Networks said it detected and blocked an attempted intrusion at an unnamed global manufacturer's India branch; the initial access method is unknown, and the attackers sought to deliver TencShell.
- ESET reported activity by China-aligned groups from October 2025 through March 2026, including SteppeDriver, PhiliKit, and NegativeGlimmer; actor links and assessments are attributed to the cited researchers.
Article Details
- Attack Vectors
- Spear-phishing emails deliver ZIP attachments containing a malicious LNK file or a binary that launches a Rust-based dropper.
- Opening the LNK executes a PowerShell script that extracts and runs RuntimeBroker_update.exe from an intermediate DAT file.
- RuntimeBroker_update.exe loads UnityPlayer.dll through DLL side-loading, leading to the RUSTCLOAK loader and the AZUREVEIL AdaptixC2 agent.
- A separate intrusion against a manufacturing customer’s India branch attempted to deliver TencShell; the initial access vector was unknown.
- A NegativeGlimmer intrusion against a government organization in Panama used spear-phishing and DLL side-loading to deliver a downloader, AdaptixC2, and a decoy document.
- Defensive Notes
- Cato Networks reported detecting and blocking the attempted intrusion targeting the India branch of a global manufacturing customer.
MITRE ATT&CK
T1059.001 · PowerShellThe Dragon Weave LNK path runs a PowerShell script to extract and launch RuntimeBroker_update.exe.T1102.002 · Bidirectional CommunicationAZUREVEIL uses Azure Blob Storage as a dead-drop channel, with the attacker and infected system exchanging data through the same storage container.T1140 · Deobfuscate/Decode Files or InformationRUSTCLOAK decrypts the main payload before running the AZUREVEIL agent.T1204.002 · Malicious FileIn one Dragon Weave path, the recipient opens a malicious LNK file disguised as a PDF; another path starts when the victim launches a binary from the archive.T1497.001 · System ChecksRUSTCLOAK performs anti-analysis checks and proceeds only if it determines it is running within a sandboxed environment.T1566.001 · Spearphishing AttachmentOperation Dragon Weave uses spear-phishing emails with ZIP attachments; a separate reported intrusion used spear-phishing to deliver a downloader.T1574.002 · DLL Side-LoadingDragon Weave uses DLL side-loading of UnityPlayer.dll to deploy RUSTCLOAK; a separate NegativeGlimmer intrusion also used a DLL side-loading chain.
People
Dr. Guy WaizelResearcher named by Cato Networks among those who assessed the capabilities TencShell could provide if the intrusion succeeded.Idan TarabResearcher named by Cato Networks among those who assessed the capabilities TencShell could provide if the intrusion succeeded.Jean-Ian BoutinESET representative who provided analysis of the reported targeting in South Korea and its connection to strategic technologies.Priya PatelSecurity researcher quoted describing the malicious files and structured infection chain in Operation Dragon Weave.Shani KurtzbergResearcher named by Cato Networks among those who assessed the capabilities TencShell could provide if the intrusion succeeded.Zohar BuberResearcher named by Cato Networks among those who assessed the capabilities TencShell could provide if the intrusion succeeded.
Threat Actors
ARMORY CASTLEA toolkit called PhiliKit is linked to UNC5221; the article says PhiliKit is suspected to be deployed as part of the SPAWN malware suite used by the group in the past.NegativeGlimmerA China-affiliated threat group reported using spear-phishing and DLL side-loading to target a government organization in Panama; later infections were reported in Cambodia and South Korea.SteppeDriverAn unreported cluster discovered in 2024 that ESET says has targeted entities in France, Mongolia, and South America using tools including ShadowPad, COOLCLIENT, CurlyDoor, RudeGull, and MKTDownloader.TGR-STA-1030Palo Alto Networks Unit 42 reportedly documented this group breaching at least 70 government and critical infrastructure organizations across 37 countries; NegativeGlimmer is believed to have some level of overlap with it.
Malware
AZUREVEILAZUREVEIL uses Microsoft Azure Blob Storage as a dead-drop C2 channel and supports 36 commands.CoolClient2024 and has since targeted entities in France, Mongolia, and South America using tools like ShadowPad, COOLCLIENT, CurlyDoor, RudeGull, and MKTDownloader.CurlyDoorsince targeted entities in France, Mongolia, and South America using tools like ShadowPad, COOLCLIENT, CurlyDoor, RudeGull, and MKTDownloader.MKTDownloaderFrance, Mongolia, and South America using tools like ShadowPad, COOLCLIENT, CurlyDoor, RudeGull, and MKTDownloader.PhiliKitThe broader activity also includes China-aligned operations using TencShell, PhiliKit, and Cobalt Strike against government, research, and critical infrastructure targets across multiple regions.RudeGullentities in France, Mongolia, and South America using tools like ShadowPad, COOLCLIENT, CurlyDoor, RudeGull, and MKTDownloader.RUSTCLOAK#OperationDragonWeaveShadowPadin 2024 and has since targeted entities in France, Mongolia, and South America using tools like ShadowPad, COOLCLIENT, CurlyDoor, RudeGull, and MKTDownloader.SPAWNIt’s suspected that PhiliKit is deployed as part of the SPAWN malware suite used by the Chinese hacking group in the past.TencShellThe broader activity also includes China-aligned operations using TencShell, PhiliKit, and Cobalt Strike against government, research, and critical infrastructure targets across multiple regions.
Vendors
Cato NetworksCato Networks blocked an intrusion delivering TencShell to a global manufacturing customer’s India branch.ESETESET linked multiple China-aligned groups to active campaigns, including SteppeDriver, PhiliKit, and NegativeGlimmer.SEQRITE LabsAccording to Seqrite Labs, targets of the campaign include government, research, academic, technology, and financial services sectors.
Products
Tools
AdaptixC2Operation Dragon Weave is a cyber espionage campaign targeting officials and citizens in the Czech Republic and Taiwan, using spear-phishing ZIP files to deploy an AdaptixC2 agent through a Rust-based infection chain.Cobalt StrikeThe broader activity also includes China-aligned operations using TencShell, PhiliKit, and Cobalt Strike against government, research, and critical infrastructure targets across multiple regions.
Countries
CambodiaSubsequent iterations in January 2026 have swapped out AdaptixC2 in favor of Cobalt Strike, with infections also reported in Cambodia and South Korea.ChinaThe broader activity also includes China-aligned operations using TencShell, PhiliKit, and Cobalt Strike against government, research, and critical infrastructure targets across multiple regions.Czech RepublicOperation Dragon Weave is a cyber espionage campaign targeting officials and citizens in the Czech Republic and Taiwan, using spear-phishing ZIP files to deploy an AdaptixC2 agent through a Rust-based infection chain.Francecluster dubbed SteppeDriver that was first discovered in 2024 and has since targeted entities in France, Mongolia, and South America using tools like ShadowPad, COOLCLIENT, CurlyDoor, RudeGull, andIndiaCato Networks blocked an intrusion delivering TencShell to a global manufacturing customer’s India branch.Mongoliacluster dubbed SteppeDriver that was first discovered in 2024 and has since targeted entities in France, Mongolia, and South America using tools like ShadowPad, COOLCLIENT, CurlyDoor, RudeGull, and MKTDownloader.Panamaobserved in December 2025, the threat actor has been found to target a governmental organization in Panama, using a DLL side-loading chain initiated via spear-phishing to deliver a downloader that then deploysSouth KoreaSubsequent iterations in January 2026 have swapped out AdaptixC2 in favor of Cobalt Strike, with infections also reported in Cambodia and South Korea.TaiwanOperation Dragon Weave is a cyber espionage campaign targeting officials and citizens in the Czech Republic and Taiwan, using spear-phishing ZIP files to deploy an AdaptixC2 agent through a Rust-based infection chain.
Industries
AcademicAccording to Seqrite Labs, targets of the campaign include government, research, academic, technology, and financial services sectors.Critical infrastructureThe broader activity also includes China-aligned operations using TencShell, PhiliKit, and Cobalt Strike against government, research, and critical infrastructure targets across multiple regions.Financial ServicesAccording to Seqrite Labs, targets of the campaign include government, research, academic, technology, and financial services sectors.GovernmentThe broader activity also includes China-aligned operations using TencShell, PhiliKit, and Cobalt Strike against government, research, and critical infrastructure targets across multiple regions.ManufacturingCato Networks blocked an intrusion delivering TencShell to a global manufacturing customer’s India branch.ResearchThe broader activity also includes China-aligned operations using TencShell, PhiliKit, and Cobalt Strike against government, research, and critical infrastructure targets across multiple regions.TechnologyAccording to Seqrite Labs, targets of the campaign include government, research, academic, technology, and financial services sectors.