Officials and citizens in the Czech Republic and Taiwan have become victims of a new cyber espionage operation called Operation Dragon Weave. Attackers are using sophisticated techniques to implement an AdaptixC2 agent using a highly developed infection chain.
Seqrite Labs has exposed this campaign, which includes attacks on government, research, and educational organizations as well as technology companies and financial services.
The activity is assessed to be China-aligned, and the attackers are using spear-phishing emails with ZIP attachments to initiate the infection.
The Infection Chain
Operation Dragon Weave cyber espionage uses two different pathways to launch the final-stage malware.
When a victim extracts the ZIP archive, they find multiple files that appear legitimate but are actually part of a structured infection chain, and the first infection sequence begins when the recipient opens a malicious Windows Shortcut (LNK) file that masquerades as a PDF document.
This LNK file executes a PowerShell script, and the PowerShell script extracts an executable called RuntimeBroker_update.exe from an intermediate DAT file and runs it.
The second infection chain in Operation Dragon Weave cyber espionage has the victim directly launching a binary from the same archive, and this binary functions as a self-contained Rust-based dropper to launch RuntimeBroker_update.exe.
DLL Side-Loading
In Operation Dragon Weave cyber espionage, regardless of how infection occurred, a malicious DLL (UnityPlayer.dll) is loaded via DLL side-loading, which allows the executable to load a malicious DLL instead of the intended legitimate DLL, which is an evasion technique.
The malicious UnityPlayer.dll then deploys a Rust-based loader (RUSTCLOAK) that has anti-analysis capabilities.
The RUSTCLOAK Loader
The RUSTCLOAK loader will only continue if the loader determines that it is not running within a sandboxed environment, and this check for sandboxed environments is designed to evade detection by automated security scanners.
If the RUSTCLOAK loader detects that it is running in a sandboxed environment, it may either terminate execution or execute benignly.
If the RUSTCLOAK loader successfully determines that it is not executing in a sandbox, it will proceed to decrypt and execute the main payload, which is an AdaptixC2 agent (AZUREVEIL).
The AZUREVEIL Agent
AZUREVEIL is the core payload of Operation Dragon Weave cyber espionage, and it is named for its use of Microsoft Azure Blob Storage for command-and-control.
Instead of using a traditional pull-based C2 model, AZUREVEIL follows a dead drop approach, the attacker and the infected system never communicate directly, instead both sides use the same Azure storage container to exchange data.
The malware just talks to Azure Blob Storage which is the same service used by thousands of legitimate enterprises worldwide, and this makes the traffic blend in with normal activity.
AZUREVEIL Capabilities
AZUREVEIL in Operation Dragon Weave cyber espionage supports 36 commands that give attackers complete control over compromised endpoints.
The agent can perform file operations including reading, writing, and deleting files, and it can upload and download files to and from the infected system.
AZUREVEIL can execute shell commands directly on the host, and it can enumerate and terminate running processes.
The Operation Dragon Weave cyber espionage agent can also perform port forwarding, control a SOCKS proxy, manage C2 servers, and execute Beacon Object Files (BOFs) in memory.
The Targets
Cyber espionage under "Operation Dragon Weave" is specifically targeting the Czech Republic and Taiwan.
The campaign targets government officials and citizens alike, while and specifically focuses on the government, research, academia, technology and financial services.
The selection of Taiwan and the Czech Republic aligns with China's strategic interests, and both regions are geopolitically relevant.
Related Campaigns: TencShell
The disclosure of Operation Dragon Weave cyber espionage comes as Cato Networks detected an attempted intrusion against an Indian branch of a global manufacturing customer.
The attackers attempted to deliver TencShell, which is a previously undocumented Go-based implant derived from the open-source rshell C2 framework.
The attack is believed to be the work of China-nexus threat actors based on the historical use of rshell, Tencent-themed API impersonation, and infrastructure patterns.
If successful, TencShell could have given the attacker remote command execution, in-memory payload execution, proxying, pivoting, system profiling, and a path to deploy additional tooling.
ESET's Findings
ESET reported that China-aligned threat actors have remained highly active globally from October 2025 through March 2026.
The company identified an unreported cluster called SteppeDriver that was first discovered in 2024, and it has since targeted entities in France, Mongolia, and South America using tools like ShadowPad, COOLCLIENT, CurlyDoor, RudeGull, and MKTDownloader.
ESET also identified a new toolkit linked to UNC5221 called PhiliKit, and PhiliKit acts as a passive backdoor for executing shell commands, Python scripts, and Perl scripts, and it is suspected that PhiliKit is deployed as part of the SPAWN malware suite.
NegativeGlimmer
A third China-affiliated threat group is NegativeGlimmer, and this group shares some level of overlap with TGR-STA-1030 which Palo Alto Networks Unit 42 documented earlier this year.
TGR-STA-1030 has breached at least 70 government and critical infrastructure organizations across 37 countries over the past year.
In one instance observed in December 2025, NegativeGlimmer targeted a governmental organization in Panama, using a DLL side-loading chain initiated via spear-phishing to deliver a downloader that then deployed AdaptixC2 and simultaneously displayed a decoy document to the victim.
Cobalt Strike is Central to NegativeGlimmer's Serial Attacks
NegativeGlimmer is implementing newer exploits against compromised systems. Just prior to January 2026, the exploit toolkit was AdaptixC2, but since it has been switched to Cobalt Strike. The APT has moved beyond operations in Vietnam, and is deploying malware and C2 activity in both Cambodia and Korea.
The attack in Korea appears to have been an operation that aligned with the Chinese government's interest in capturing strategic technologies that are being target under the 'Made in China 2025' industrial policy.
The move from AdaptixC2 to Cobalt Strike indicates that NegativeGlimmer may be attempting to take advantage of new tools within the same adversarial ecosystem, or that there may be rogue groupings within the larger adversarial ecosystem that are using unique tools for C2 protocols.
Dead Drop C2 Technique
The dead drop C2 technique employed by the APT behind Operation Dragon Weave is notable among cyber espionage threats. Instead of the malware contacting a C2 server that the attacker owns, the malware and the attacker access the same legitimate cloud storage service as a dead drop.
Whenever the malware accesses the Azure blob container for a command, the attacker also writes a command to the Azure blob container, allowing the malware to operate completely unaware of the attacker's command and control server IP address.
The use of a dead drop in this operation complicates the task of disrupting this cyber espionage operation, as the downtime of the attacker's infrastructure will not have a negative impact on the continued availability of the malware once the Azure blob container remains available.
How to Protect Your Organization
Operation Dragon Weave cyber espionage and related campaigns are active, here is what you need to do:
1. Provide training on spear-phishing techniques. Each successful entry into a spear-phishing attack is typically through a phishing email containing an attachment in a zip format. Therefore, all users should be educated to be cautious about opening unexpected email attachments.
2. Implement endpoint detection & response systems. The (malware) utilized in Operation Dragon Weave is set up to use dll (dynamic linked library) side loading as well as rust loaders; endpoint detection & response systems may help in identifying and monitoring these types of activities.
3. Continuously log the access to your azure blob storage. The cyber espionage effort associated with Operation Dragon Weave utilizes azure blob storage for their command and control operations, organizations should log unexpected requests to access Azure storage from devices other than those owned by or utilized by them.
4. Do everything possible to block PowerShell execution by users. Many of the steps in the infection chain outlined previously rely on the ability of a user to execute PowerShell scripts; therefore, blocking PowerShell will significantly reduce the potential for a user to be compromised.
5. Enforce the principle of least privilege across the organization. The malware associated with this threat will run with the privilege of the user, therefore limiting the privileges granted to each user will help restrict the potential for malicious actions carried out by a user.
Considerations
The operation called Dragon Weave is a cyber spying operation by China-based threat groups against certain geographic and economic areas of interest to the Chinese government.
The new use of an Azure Blob Storage account in this case as an alternative command and control (C2) delivery and dissemination method demonstrates how cybercriminals are utilizing an otherwise legitimate service in order to avoid detection from security technologies. The use of a Rust-based loader containing anti-analysis techniques also demonstrates the ongoing evolution of malware creation and development.
The attempted attacks on Czech Republic and Taiwan are consistent with the geopolitical objectives of the Chinese government and demonstrate that China’s cyber espionage groups remain active and working against targets throughout the world.
As such, if you are a representative of any of these vertical markets in either the Czech Republic or Taiwan, be particularly aware of the possible intent of spear phishing against you in an email message.
FAQ Section
What is Operation Dragon Weave cyber espionage?
Operation Dragon Weave cyber espionage is a campaign targeting officials and citizens in the Czech Republic and Taiwan, it uses spear-phishing emails with ZIP attachments to deliver an AdaptixC2 agent called AZUREVEIL.
What makes AZUREVEIL unique?
AZUREVEIL uses a dead drop C2 approach with Microsoft Azure Blob Storage, the attacker and infected system never communicate directly, instead both use the same Azure storage container to exchange data.
Which sectors are specifically targeted by Operation Dragon Weave?
The campaign has specified targets in the following key sectors: government; research; academia; IT; and FSI.
What is RUSTCLOAK?
RUSTCLOAK is a Rust-based loader that performs checks used to detect if the host environment is a Virtual Machine (i.e., sandboxed, virtualized) before running any payloads. Once the checks are completed, RUSTCLOAK will then decrypt the AZUREVEIL agent (also known as AdaptixC2).
Is Operation Dragon Weave linked to other threat actor groups from or aligned with China?
Yes, ESET has identified several campaigns that appear to be connected to the current campaign, including but not limited to: SteppeDriver; PhiliKit (which have ties to UNC5221); and NegativeGlimmer (also have ties to: TGR-STA-1030).
