AZUREVEIL
AZUREVEIL is the final payload used in the Operation Dragon Weave spear-phishing espionage campaign. It is described as a fully functional Adaptix command-and-control agent compiled as a 64-bit DLL, with reporting noting MinGW C++ compilation and runtime resolution of roughly 87 Windows APIs via djb2-based hashing. The malware is deployed after DLL sideloading and execution of the intermediate Rust-based loader RUSTCLOAK, which decrypts and launches AZUREVEIL directly in memory. Observed initial infection vectors were ZIP archives delivered via phishing emails, including government-themed lures and decoy documents, with two execution paths: a malicious LNK leading to VBScript/PowerShell execution, or a Rust-based dropper executable. Both paths converge on RuntimeBroker_update.exe and malicious UnityPlayer.dll sideloading before AZUREVEIL is loaded.
A defining characteristic of AZUREVEIL is its command-and-control design: instead of using a conventional external C2 server, it uses Microsoft Azure Blob Storage as a dead-drop C2 channel, allowing attacker commands, victim beacons, and exfiltrated results to be exchanged through encrypted blobs in a shared Azure container. This makes the traffic resemble normal enterprise cloud usage. Reported infrastructure details include note1ggbbhggdwa1[.]blob[.]core[.]windows[.]net over HTTPS/443, container path /note/ats/, agent ID 345831bc, and a hardcoded Azure Shared Access Signature token valid from 2026-03-19 to 2027-03-19 with read, write, and delete permissions. Reporting also states that AZUREVEIL periodically uploads a small encrypted beacon of about 124 bytes to indicate host activity.
The payload reportedly implements 36 command handlers supporting post-exploitation activity including file operations, filesystem modification, shell execution, process listing and manipulation, process control, port forwarding and network pivoting, downloading secondary files, local document exfiltration, and in-memory execution of Beacon Object Files. The campaign targeted organizations and individuals in the Czech Republic and Taiwan, especially government and public sector, research and academia, technology and software, and financial services. Seqrite assessed the broader campaign with moderate confidence as China-linked, but did not attribute it to a specific named APT group. Associated filenames and artifacts mentioned in reporting include RuntimeBroker_update.exe, UnityPlayer.dll, Profile.ps1, empty.vbs, 1.dat, and Com.dat.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
25 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique"Operation Dragon Weave," a spear-phishing campaign that starts with sending email to a target with an attached zip file and instructions to open it, under the guise of something like an upcoming business meeting or ... an appointment with the Czech Social Security Administration (ČSSZ).
Execution
4 techniquesAzureveil retrieves these commands, decrypts them, executes them, and uploads the results back as encrypted blobs.
...clicking on an enclosed LNK shortcut file, which runs a PowerShell script to decrypt all necessary components; it then executes them through a file named RuntimeBroker_update.exe.
the agent contains a specialized Beacon Object File (BOF) parsing engine. This engine runs compiled C scripts inside the local host memory without touching physical disks.
The primary way the infection starts is through clicking on an enclosed LNK shortcut file, which runs a PowerShell script to decrypt all necessary components...
Persistence
1 techniquePrivilege Escalation
2 techniquesthe loader deploys unique Windows fibers to transfer execution over to the decrypted shellcode. This method injects a fully functional remote control agent directly into system RAM.
Stealth
4 techniquesAZUREVEIL resolves around 87 Windows APIs at runtime using a djb2-based hashing method.
the loader deploys unique Windows fibers to transfer execution over to the decrypted shellcode. This method injects a fully functional remote control agent directly into system RAM.
Once the infection chain completes, a Rust-based loader known as RUSTCLOAK takes over and decrypts the final payload through a triple-layer process involving modified RC4, Base64 decoding, and AES-CBC encryption.
Stage four launches AZUREVEIL directly in memory, leaving almost nothing behind on disk for investigators to find... running Beacon Object Files entirely in memory without touching disk.
Defense Impairment
1 techniqueAZUREVEIL supports 36 commands that allow it to perform a wide range of post-compromise actions on the host, including file operations, file uploads and downloads...
Discovery
3 techniquesThese features allow the attacker to execute filesystem changes, manipulate running processes, and forward ports.
C2 Management Reconfigure C2 settings at runtime Control file transfer state Retrieve system uptime
These features allow the attacker to execute filesystem changes... For instance, operators can pull down secondary files or exfiltrate sensitive local documents seamlessly.
Collection
2 techniquesThe zip file attached to the spear-phishing email contains multiple files, including an executable that opens a decoy PDF...
The attack begins with a ZIP archive delivered via email... Analysts at Seqrite... noted the use of two separate delivery paths contained within a single archive.
Command and Control
6 techniquesInstead of talking to a normal C2 server, the malware blends its traffic with regular cloud activity, which makes it much harder to notice.
AZUREVEIL supports 36 commands that allow it to perform a wide range of post-compromise actions on the host, including ... port forwarding, SOCKS proxy control...
These features allow the attacker to execute filesystem changes, manipulate running processes, and forward ports.
Rather than communicating with a traditional C2 server, it routes all activity through Microsoft Azure Blob Storage, making its traffic nearly indistinguishable from normal enterprise cloud usage.
"Instead of using a traditional pull-based C2 model, Azureveil follows a dead-drop approach," ... "The attacker and the infected system never communicate directly. Instead, both sides use the same Azure storage container to exchange data."
These features allow the attacker to execute filesystem changes, manipulate running processes, and forward ports. For instance, operators can pull down secondary files or exfiltrate sensitive local documents seamlessly.
Exfiltration
3 techniquesAzureveil retrieves these commands, decrypts them, executes them, and uploads the results back as encrypted blobs... they can execute commands and exfiltrate files from the target system...
Operation Dragon Weave relies entirely on a customized dead-drop C2 channel built inside legitimate cloud platforms. The system uses public storage spaces to pass encrypted commands and exfiltrated files safely.
One of the unique aspects of this campaign is its use of Microsoft Azure Blob Storage as a dead-drop C2 channel.
IOCs tracked for this family
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote control agent/final payload that uses Microsoft Azure Blob Storage as a dead-drop C2 channel, blending with normal cloud traffic while supporting command execution, file operations, process manipulation, port forwarding, exfiltration, and in-memory BOF execution.
A 64-bit Adaptix C2 agent that uses Azure Blob Storage as a dead-drop resolver for command-and-control. It supports extensive post-exploitation capabilities including file operations, shell execution, process listing, port forwarding, and in-memory execution of Beacon Object Files.
A payload used for command-and-control and data exfiltration that relies on Microsoft Azure Blob Storage in a dead-drop C2 model, uploading encrypted beacons, retrieving commands, executing them, and returning encrypted results.
Final payload and fully featured Adaptix C2 agent that uses Azure Blob Storage as a dead-drop command-and-control channel. It supports extensive post-exploitation functions including file operations, shell execution, process control, proxying/pivoting, exfiltration, and in-memory Beacon Object File execution.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.