Loading story…
Researchers uncovered Operation Dragon Weave, a spearphishing espionage campaign targeting officials and citizens in Taiwan and the Czech Republic with region-specific lures. Victims received ZIP archives that triggered one of two infection chains: a malicious .lnk file launching a VBScript-and-PowerShell sequence, or a Rust-based dropper that unpacked components directly. Both paths led to DLL sideloading of a malicious UnityPlayer.dll, a Rust loader dubbed RUSTCLOAK that decrypted and executed the next-stage payload entirely in memory.
The final payload, AZUREVEIL, was identified as an Adaptix C2 agent that used Microsoft Azure Blob Storage as a dead-drop command-and-control channel over HTTPS, allowing encrypted tasking, data exfiltration, and in-memory BOF execution while blending into legitimate cloud traffic. Seqrite reported anti-analysis checks, multilayer payload encryption, and a hardcoded Azure SAS token valid for a year, indicating an effort to preserve stealth and persistence. Based on the targeting, tooling, and tradecraft, researchers assessed with moderate confidence that the operation is linked to a China-based threat actor, though no specific group was named.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Seqrite Labs described Operation Dragon Weave as a targeted spearphishing espionage campaign aimed at officials and citizens in Taiwan and the Czech Republic. The report detailed the infection chain, including RUSTCLOAK and the AZUREVEIL payload using Azure Blob Storage as dead-drop C2, and assessed the campaign with moderate confidence as linked to a China-based threat actor.
Bitdefender published a blog post titled "APT36: A Nightmare of Vibeware," indicating public disclosure and analysis of activity associated with APT36 and the Vibeware malware family.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcesecurityonline.info
Open sourcecybersecuritynews.com
Open sourcedarkreading.com
Open sourcethehackernews.com
Open sourcemalware.news
Open sourcebitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Silver Dragon**, an emerging China-linked threat actor assessed as part of the **APT41** ecosystem, has conducted cyberespionage operations against **government entities in Europe and Southeast Asia** since at least mid-2024. Reporting based on Check Point research says the group gains initial access through a mix of **exploitation of public-facing servers** and **phishing emails with malicious attachments**, then blends into normal activity by **hijacking legitimate Windows services** for persistence and command-and-control (C2). The activity includes a toolchain that uses **heavily obfuscated loaders** (including **MonikerLoader** and **BamboLoader**) to decrypt and inject payloads in memory, with **Cobalt Strike** beacons commonly deployed as a final-stage payload. Check Point also observed **Google Drive-based C2** as an evasion technique, alongside Cobalt Strike configurations that can use **DNS tunneling**, **HTTP via Cloudflare**, or **SMB** for internal communications; additional custom post-exploitation tooling (e.g., screenshot capture utilities) was also reported, and artifacts suggested an **automated framework** for generating per-target attack packages (e.g., consistent file timestamps and recovered configuration logs with paths, service names, keys, and injected processes).
Jun 29, 2026
Check Point Research attributed a set of tightly scoped cyber-espionage campaigns against **government and law enforcement** organizations in Southeast Asia to a China-linked activity cluster it tracks as **Amaranth-Dragon**, assessed as connected to the broader **APT41** ecosystem. Targeting was reported across **Cambodia, Thailand, Laos, Indonesia, Singapore, and the Philippines**, with lures aligned to local geopolitical events and infrastructure configured for stealth, including **geofencing** so command-and-control only interacted with victims in specific countries. The intrusion chain evolved over 2025, and—shortly after public disclosure—began weaponizing the WinRAR vulnerability **CVE-2025-8088** via malicious RAR archives to achieve code execution and persistence. Reporting describes Amaranth-Dragon using a custom **Amaranth Loader** to deliver encrypted payloads, with C2 infrastructure shielded behind **Cloudflare** and use of legitimate services (e.g., *Dropbox*) to stage content; Check Point also documented deployment of the **Havoc C2 framework** and a newly tracked **TGAmaranth RAT** that uses **Telegram bot-based C2** and includes anti-EDR/anti-AV features. Separate coverage notes CVE-2025-8088’s exploitation mechanics (including abuse of Windows **Alternate Data Streams (ADS)** to write to arbitrary locations such as Startup paths) and that multiple other threat groups have also exploited the flaw, underscoring ongoing operational risk beyond this single actor.
Jun 29, 2026
Reporting highlighted multiple **state-sponsored espionage** operations, including a China-linked campaign attributed to **Camaro Dragon** targeting entities in **Qatar** with conflict-themed phishing lures that install the **PlugX** backdoor. The activity was observed rapidly following a new Middle East escalation, using war-related decoy documents and parallel infection chains with differing delivery methods and payloads, indicating more than one operator set involved and underscoring how quickly geopolitical events are operationalized for access and collection. Separately, **Russia’s APT28** (aka *Fancy Bear/Forest Blizzard/Sednit*) was reported using a heavily modified variant of the open-source **Covenant** post-exploitation framework alongside implants such as **BeardShell** and **SlimAgent** in long-term espionage against **Ukrainian** targets. The tradecraft described includes exploitation of `CVE-2026-21509` via malicious Microsoft Office documents and command-and-control over legitimate cloud services (e.g., *Icedrive*), consistent with stealth-focused persistence and surveillance operations against government and military-related environments.
Jun 29, 2026