Seqrite Analyzes Operation Dragon Weave’s Azure-Based C2 Campaign
Summary
Seqrite details a spearphishing campaign targeting the Czech Republic and Taiwan that delivers AZUREVEIL, an Adaptix C2 agent using Azure Blob Storage. The researchers assess a China-based link with moderate confidence.
Key points
- The campaign used region-specific lures and ZIP attachments targeting people and organizations in the Czech Republic and Taiwan.
- Two delivery paths—a malicious LNK with VBScript and PowerShell, or a Rust-compiled executable—converged on DLL sideloading and the RUSTCLOAK loader.
- RUSTCLOAK used sandbox checks, layered decryption and Windows fibers to load AZUREVEIL in memory.
- AZUREVEIL is an Adaptix C2 agent with 36 commands, including file operations, data exfiltration, proxying and in-memory BOF execution.
- The agent used Azure Blob Storage at note1ggbbhggdwa1[.]blob[.]core[.]windows[.]net for dead-drop command-and-control over HTTPS.
- Seqrite links the campaign to a China-based threat actor with moderate confidence but does not attribute it to a specific known group.
Article Details
- Attack Vectors
- Spearphishing ZIP attachments used region-specific Czech and Traditional Chinese lures to deliver a malicious LNK file or executable.
- The LNK path launched empty.vbs and Profile.ps1 to decrypt 1.dat and execute RuntimeBroker_update.exe; the executable path extracted and launched components directly.
- RuntimeBroker_update.exe sideloaded a malicious UnityPlayer.dll, which loaded the RUSTCLOAK loader and then AZUREVEIL in memory.
- AZUREVEIL used Azure Blob Storage as dead-drop command-and-control and supported file exfiltration, remote commands, proxying, and in-memory BOF execution.
- Defensive Notes
- Monitor for the campaign's reported Azure Blob Storage C2 hostname, note1ggbbhggdwa1[.]blob[.]core[.]windows[.]net, while accounting for legitimate Azure traffic.
- Investigate the listed SHA-256 hashes and the reported LNK, executable, DLL, script, and encrypted-payload artifacts.
- Inspect suspicious ZIP contents and chains involving hidden VBScript or PowerShell execution, RuntimeBroker_update.exe, and UnityPlayer.dll sideloading.
- Sandbox analysis may be evaded: RUSTCLOAK reportedly exits when the computer name matches its hardcoded list of analysis-system names.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | note1ggbbhggdwa1[.]blob[.]core[.]windows[.]net | Reported Azure Blob Storage dead-drop C2 hostname used by AZUREVEIL. |
| SHA256 | 02542a49b3bd6bd2795afb67840acb4557b17e017f7503dd03ebe3aeeb28720e | SHA-256 of the decoy PDF embedded in the executable dropper, listed in the IOC table. |
| SHA256 | 047687548605734348792e2a9d771b6cba42facd0d0d7d44d778290a25848574 | SHA-256 of 1.dat, the encrypted container decrypted by Profile.ps1 to produce RuntimeBroker_update.exe. |
| SHA256 | 080ab9bc2893ba7bad354551604a667af40ed2ae2d042d2323c2bd9ad3122192 | SHA-256 of the malicious UnityPlayer.dll sideloading component listed in the article's IOC table. |
| SHA256 | 096372d19b4787e989f44e04c5ecc29885aa927c34ae8666628d6c0eb20bb447 | SHA-256 of the malicious LNK delivery file listed in the article's IOC table. |
| SHA256 | 1c56228cbd1bdebb9e5ea55c2749150fee06c865ede4a3754e8bd6843e51d2d4 | SHA-256 of the executable dropper listed in the article's IOC table. |
| SHA256 | 24aa4e780ccd66cef13da9ef98c32954105cf2a32ec643efab0ba1aa2d6352f4 | SHA-256 of Com.dat, the encrypted payload read by RUSTCLOAK, listed in the IOC table. |
| SHA256 | 5ed14c2b7f7433a1a72dd6b668413f935a217ba10b69d89b774a82990fa12fe1 | SHA-256 of BrowserViewUtility.exe, a component used in the executable delivery path and listed in the IOC table. |
| SHA256 | 61f7d9cd2d8ce7df950639b23ce90085b300b0c6dd0d8d934bba8fdecb670f15 | SHA-256 of RuntimeBroker_update.exe, the executable used for DLL sideloading, listed in the IOC table. |
| SHA256 | 783661d0f7edb338d2d50be087764d82dbbc9ee7989ddc57db1801e4ec9045b0 | SHA-256 of azureveil.exe, the final payload listed in the article's IOC table. |
| SHA256 | 823d5969db3f3b72ebbdce1b78752717ea849884a0fb40d86146416c38e128de | SHA-256 of Profile.ps1, the script that decrypts 1.dat and executes the next-stage binary. |
| SHA256 | 8ae7c82a3e4f742777e590b25a1c563d19bd9bcba2a387d004aae72c4b2828f9 | SHA-256 of a lure PDF found in the extracted archive, listed in the IOC table. |
| SHA256 | a4e9f9919d62589b57cfa08c9ccb89e386b09f683271373413cd8e8c8c7d1c5a | SHA-256 of empty.vbs, the script that launches the PowerShell stage, listed in the IOC table. |
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryAZUREVEIL supported network-adapter enumeration, including MAC address, IP address, and adapter type.T1027 · Obfuscated Files or InformationThe chain used XOR, modified RC4, Base64, and SM4-CBC processing to conceal payloads.T1041 · Exfiltration Over C2 ChannelThe agent uploaded files and execution results to Azure Blob Storage through its C2 channel.T1057 · Process DiscoveryAZUREVEIL supported listing running processes.T1059.001 · PowerShellThe LNK-triggered chain launched Profile.ps1 through PowerShell to decrypt 1.dat and execute RuntimeBroker_update.exe.T1059.005 · Visual Basicempty.vbs acted as a VBScript bridge that launched the PowerShell stage.T1083 · File and Directory DiscoveryAZUREVEIL supported listing directory contents and logical drives.T1090 · ProxyAZUREVEIL supported SOCKS proxy control and port forwarding for pivoting.T1102.001 · Dead Drop ResolverAZUREVEIL used Azure Blob Storage as a dead-drop resolver for exchanging commands and results.T1105 · Ingress Tool TransferAZUREVEIL supported dropping files from C2 to the victim system and queuing file downloads.T1204.002 · Malicious FileThe infection chain began when a victim clicked the LNK or ran the executable from the archive.T1497.001 · System ChecksRUSTCLOAK checked the computer name against a hardcoded list of sandbox and analyst-system names and exited on a match.T1566.001 · Spearphishing AttachmentThe campaign used spearphishing ZIP attachments containing a malicious LNK or executable and regional lure documents.T1573 · Encrypted ChannelThe agent exchanged encrypted beacons, commands, and results through HTTPS Azure Blob Storage traffic.T1574.002 · DLL Side-LoadingRuntimeBroker_update.exe loaded the malicious UnityPlayer.dll placed in the same folder.
Malware
Vendors
Products
Tools
Countries
ChinaThe final payload is an Adaptix C2 agent that abuses Microsoft Azure Blob Storage for dead-drop command-and-control, and the campaign is assessed to be linked with moderate confidence to a China-based threat actor.Czech Republictracked Operation Dragon Weave, a spearphishing campaign targeting officials and citizens in the Czech Republic and Taiwan with lure documents, ZIP attachments, and a multi-stage infection chain leading toTaiwanDragon Weave, a spearphishing campaign targeting officials and citizens in the Czech Republic and Taiwan with lure documents, ZIP attachments, and a multi-stage infection chain leading to AZUREVEIL.
Industries
Financial ServicesThe campaign targeted government and public sector, research and academia, technology and software, and financial services organizations.Government and public sectorThe campaign targeted government and public sector, research and academia, technology and software, and financial services organizations.Research and academiaThe campaign targeted government and public sector, research and academia, technology and software, and financial services organizations.technology and softwareThe campaign targeted government and public sector, research and academia, technology and software, and financial services organizations.