China-Aligned Groups Ramp Up Attacks: Dragon Weave Hits Czech Republic & Taiwan
Seqrite Labs says Operation Dragon Weave targeted Czech and Taiwanese victims with phishing ZIP files to deploy a Rust loader and AdaptixC2.
Intelligence analysis by GPT-5.4 Mini
The article describes a China-aligned espionage campaign that uses spear-phishing ZIP archives, DLL sideloading, and Azure Blob Storage to hide command-and-control traffic. It also places the activity alongside other recent China-linked implants and toolkits seen by multiple security firms.
A group of attackers used fake email files to trick people into opening them. Once opened, the files quietly dropped a hidden helper program onto the computer, like slipping a lockpick into a backpack without anyone noticing.
That helper then opened the door for a bigger spy tool. Instead of calling home in an obvious way, it used a normal cloud storage service to pass messages, which made it harder to spot.
The story matters because it shows how sneaky these attacks can be. Even a simple-looking file can be the first step in giving an attacker control of a whole computer.
Analysis
Operation Dragon Weave
Seqrite Labs says a campaign it calls Operation Dragon Weave is targeting officials and citizens in the Czech Republic and Taiwan. The suspected victim pool includes government, research, academic, technology, and financial services organizations, which makes the operation relevant to both public-sector and private-sector defenders.
The delivery method is a familiar one: spear-phishing emails with ZIP attachments. Inside the archive, the files are arranged to look legitimate, but they kick off an infection chain built to run malware quietly in the background. In one path, the victim opens a Windows shortcut file disguised as a PDF, which launches PowerShell, extracts an executable from an intermediate DAT file, and runs it. In the second path, the user directly starts a binary from the archive; that file acts as a self-contained Rust dropper.
Loader and payload
Both branches lead to RuntimeBroker_update.exe, which loads a malicious DLL named UnityPlayer.dll through DLL side-loading. That DLL deploys a Rust-based loader called RUSTCLOAK, which decrypts and launches the final payload: an AdaptixC2 agent referred to as AZUREVEIL. Seqrite says the name reflects the use of Microsoft Azure Blob Storage as the command-and-control layer.
The article says AZUREVEIL uses a dead-drop approach rather than a direct C2 connection. In practice, both attacker and victim use the same Azure storage container to exchange data, which helps the traffic blend into normal enterprise cloud usage. Seqrite also says the loader performs anti-analysis checks and only continues when the environment looks like a sandbox.
Once active, AZUREVEIL supports 36 commands. Those include file operations, uploads and downloads, shell execution, process listing and termination, port forwarding, SOCKS proxy control, C2 management, and in-memory execution of BOFs. That combination gives an operator broad control over an infected host and a path for follow-on access.
Wider China-linked activity
The article also cites Cato Networks blocking a separate attempt against the Indian branch of a global manufacturing company. That case involved TencShell, a previously undocumented Go-based implant tied to China-nexus activity through its rshell lineage, Tencent-themed API impersonation, and infrastructure patterns. Cato said the initial access method was still unknown.
ESET adds broader context, saying China-aligned actors stayed highly active globally from October 2025 through March 2026. It points to SteppeDriver, PhiliKit, and NegativeGlimmer as examples of ongoing tooling and targeting, including campaigns against government and critical infrastructure organizations across multiple regions.
Key points
- Seqrite Labs says Operation Dragon Weave is targeting Czech and Taiwanese victims with spear-phishing ZIP files.
- The infection chain uses LNK files, PowerShell, DLL side-loading, and a Rust loader called RUSTCLOAK.
- The final payload, AZUREVEIL, is an AdaptixC2 agent that uses Azure Blob Storage as a dead-drop C2 channel.
- AZUREVEIL supports 36 commands, including file operations, shell execution, proxying, and in-memory BOF execution.
- The article also cites other China-linked activity, including TencShell, SteppeDriver, PhiliKit, and NegativeGlimmer.
The campaign was detected and analyzed before the article describes widespread public damage, and at least one related intrusion attempt was blocked by Cato Networks. Security teams that watch for phishing archives, DLL side-loading, and unusual cloud-storage use can use these details to improve detection and prevention.
The tooling described is built for stealth and broad post-compromise control, so a successful intrusion could lead to data theft, proxying, pivoting, and additional payload delivery. The use of common cloud infrastructure for command-and-control also makes the activity harder to distinguish from legitimate enterprise traffic.
