China-Aligned Groups Ramp Up Attacks: Dragon Weave Hits Czech Republic & Taiwan

Published:

1 juni 2026 om 11:54:24

Alert date:

1 juni 2026 om 15:01:43

Source:

thehackernews.com

Ransomware & Malware, Data Breach & Exfiltration, Critical Infrastructure, Email & Messaging

China-aligned threat actors launched Operation Dragon Weave, a cyber espionage campaign targeting officials and citizens in the Czech Republic and Taiwan. The campaign delivers AdaptixC2 agent through spear-phishing emails containing ZIP attachments. Targets include government, research, academic, technology, and financial services sectors. The operation represents an escalation in China-aligned cyber activities against these specific countries.

Technical details

Operation Dragon Weave is a cyber espionage campaign targeting Czech Republic and Taiwan using spear-phishing emails with ZIP attachments. The attack uses two infection paths: 1) malicious Windows Shortcut (LNK) file masquerading as PDF that executes PowerShell script to extract and run RuntimeBroker_update.exe from DAT file, 2) direct execution of Rust-based dropper binary. Both paths lead to DLL side-loading of UnityPlayer.dll, deploying RUSTCLOAK loader that decrypts and runs AZUREVEIL AdaptixC2 agent. AZUREVEIL uses Microsoft Azure Blob Storage for C2 communications via dead drop approach, supports 36 commands including file operations, shell execution, process management, port forwarding, SOCKS proxy, and Beacon Object Files execution. Additional campaigns include TencShell implant derived from rshell framework targeting Indian manufacturing, and PhiliKit backdoor linked to UNC5221 group.

Mitigation steps:

Monitor for spear-phishing emails with ZIP attachments, detect malicious LNK files masquerading as PDFs, implement anti-analysis detection for sandboxed environments, monitor Azure Blob Storage communications for suspicious dead drop patterns, watch for DLL side-loading activities involving UnityPlayer.dll and RuntimeBroker_update.exe, and implement detection for the 36 AZUREVEIL command capabilities including file operations and remote execution.

Affected products:

Microsoft Azure Blob Storage
Windows (LNK files
PowerShell
DLL side-loading)
AdaptixC2
Cobalt Strike
ShadowPad
COOLCLIENT
CurlyDoor
RudeGull
MKTDownloader
rshell C2 framework

Related CVE's:

Related threat actors:

IOC's:

RuntimeBroker_update.exe, UnityPlayer.dll, RUSTCLOAK loader, AZUREVEIL AdaptixC2 agent, TencShell implant, PhiliKit backdoor

This article was created with the assistance of AI technology by Perceptive.