Operation Dragon Weave: China-Linked Cyber Espionage Campaign Targets Czech and Taiwanese Government Institutions via Cloud C2

Seqrite's APT Team on June 4 disclosed Operation Dragon Weave, a spearphishing campaign active since at least March 2026 targeting government, research, and technology personnel in the Czech Republic and Taiwan 1Adaptix C2 Agent via Spearphishing Campaign" data-source="Cybersecurity News" data-url="https://cybersecuritynews.com/hackers-deploy-azureveil-adaptix-c2-agent/" data-rt="secondary" data-otype="trade_press">2. Two delivery paths within the ZIP archive, an LNK shortcut or a Rust dropper, converge on RUSTCLOAK, a Rust loader that screens the host name against over 100 hardcoded sandbox indicators before applying triple-layer decryption to extract the final payload 123. That payload, AZUREVEIL, is an Adaptix C2 agent that routes all traffic through Microsoft Azure Blob Storage via a dead-drop resolver and supports 36 post-exploitation commands including in-memory Beacon Object File execution 123. Seqrite attributed the campaign to a China-linked actor with moderate confidence based on technical artifacts and targeting patterns, but did not link it to any specific known APT group, noting the techniques had not been previously documented in publicly known Chinese APT activity; RUSTCLOAK also contained a plaintext Rust build path exposing the developer username "dell2" 12.