Loading malware…
AZUREVEIL is the final payload used in the Operation Dragon Weave spear-phishing espionage campaign. It is described as a fully functional Adaptix command-and-control agent compiled as a 64-bit DLL, with reporting noting MinGW C++ compilation and runtime resolution of roughly 87 Windows APIs via djb2-based hashing. The malware is deployed after DLL sideloading and execution of the intermediate Rust-based loader RUSTCLOAK, which decrypts and launches AZUREVEIL directly in memory. Observed initial infection vectors were ZIP archives delivered via phishing emails, including government-themed lures and decoy documents, with two execution paths: a malicious LNK leading to VBScript/PowerShell execution, or a Rust-based dropper executable. Both paths converge on RuntimeBroker_update.exe and malicious UnityPlayer.dll sideloading before AZUREVEIL is loaded.
A defining characteristic of AZUREVEIL is its command-and-control design: instead of using a conventional external C2 server, it uses Microsoft Azure Blob Storage as a dead-drop C2 channel, allowing attacker commands, victim beacons, and exfiltrated results to be exchanged through encrypted blobs in a shared Azure container. This makes the traffic resemble normal enterprise cloud usage. Reported infrastructure details include note1ggbbhggdwa1[.]blob[.]core[.]windows[.]net over HTTPS/443, container path /note/ats/, agent ID 345831bc, and a hardcoded Azure Shared Access Signature token valid from 2026-03-19 to 2027-03-19 with read, write, and delete permissions. Reporting also states that AZUREVEIL periodically uploads a small encrypted beacon of about 124 bytes to indicate host activity.
The payload reportedly implements 36 command handlers supporting post-exploitation activity including file operations, filesystem modification, shell execution, process listing and manipulation, process control, port forwarding and network pivoting, downloading secondary files, local document exfiltration, and in-memory execution of Beacon Object Files. The campaign targeted organizations and individuals in the Czech Republic and Taiwan, especially government and public sector, research and academia, technology and software, and financial services. Seqrite assessed the broader campaign with moderate confidence as China-linked, but did not attribute it to a specific named APT group. Associated filenames and artifacts mentioned in reporting include RuntimeBroker_update.exe, UnityPlayer.dll, Profile.ps1, empty.vbs, 1.dat, and Com.dat.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
"Operation Dragon Weave," a spear-phishing campaign that starts with sending email to a target with an attached zip file and instructions to open it, under the guise of something like an upcoming business meeting or ... an appointment with the Czech Social Security Administration (ČSSZ).
Azureveil retrieves these commands, decrypts them, executes them, and uploads the results back as encrypted blobs.
...clicking on an enclosed LNK shortcut file, which runs a PowerShell script to decrypt all necessary components; it then executes them through a file named RuntimeBroker_update.exe.
AZUREVEIL resolves around 87 Windows APIs at runtime using a djb2-based hashing method.
the loader deploys unique Windows fibers to transfer execution over to the decrypted shellcode. This method injects a fully functional remote control agent directly into system RAM.
Instead of talking to a normal C2 server, the malware blends its traffic with regular cloud activity, which makes it much harder to notice.
AZUREVEIL supports 36 commands that allow it to perform a wide range of post-compromise actions on the host, including ... port forwarding, SOCKS proxy control...
These features allow the attacker to execute filesystem changes, manipulate running processes, and forward ports.
Rather than communicating with a traditional C2 server, it routes all activity through Microsoft Azure Blob Storage, making its traffic nearly indistinguishable from normal enterprise cloud usage.
Azureveil retrieves these commands, decrypts them, executes them, and uploads the results back as encrypted blobs... they can execute commands and exfiltrate files from the target system...
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote control agent/final payload that uses Microsoft Azure Blob Storage as a dead-drop C2 channel, blending with normal cloud traffic while supporting command execution, file operations, process manipulation, port forwarding, exfiltration, and in-memory BOF execution.
A 64-bit Adaptix C2 agent that uses Azure Blob Storage as a dead-drop resolver for command-and-control. It supports extensive post-exploitation capabilities including file operations, shell execution, process listing, port forwarding, and in-memory execution of Beacon Object Files.
A payload used for command-and-control and data exfiltration that relies on Microsoft Azure Blob Storage in a dead-drop C2 model, uploading encrypted beacons, retrieving commands, executing them, and returning encrypted results.
Final payload and fully featured Adaptix C2 agent that uses Azure Blob Storage as a dead-drop command-and-control channel. It supports extensive post-exploitation functions including file operations, shell execution, process control, proxying/pivoting, exfiltration, and in-memory Beacon Object File execution.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.