China Uses Dual-Method Cyberattack on Czech Orgs

Operation Dragon Weave is a China-attributed spear-phishing campaign targeting government, research/academia, technology/software, and financial organizations in the Czech Republic and Taiwan. Attackers deliver a ZIP attachment containing either an LNK that launches a PowerShell-based chain or an executable Rust dropper that ultimately runs RuntimeBroker_update.exe, which loads a Rust-based loader (Rustcloak) that decrypts and executes an Adaptix C2 agent (Azureveil). Azureveil uses Microsoft Azure Blob Storage as a dead-drop C2 for encrypted beacons, commands, and exfiltrated data; Rustcloak includes anti-analysis/sandbox-evasion checks. Seqrite recommends phishing defenses, EDR/XDR/FIM, SIEM/log centralization, process monitoring, and email filtering to mitigate the threat.