AZUREVEIL Adaptix C2 Agent Delivered via Targeted Spearphishing Attacks

A highly targeted spear-phishing campaign targeting government officials and citizens in the Czech Republic and Taiwan.

Attributed to a China-linked threat actor, the operation relies on decoy documents mimicking official communications, such as Czech Social Security appointment notices and Taiwanese project review forms.

The attack begins with a ZIP attachment containing a structured infection chain that silently deploys a sophisticated post-exploitation payload.

Victims are infected through one of two initial delivery paths. The first method uses a malicious shortcut file disguised as a PDF, which quietly executes a VBScript and PowerShell chain.

The second method uses a self-contained Rust executable that automatically drops all necessary components.

Both paths converge by dropping a file named RuntimeBroker_update.exe, which abuses DLL sideloading to execute a malicious file called UnityPlayer.dll. This file contains a custom Rust-based loader dubbed RUSTCLOAK.

AZUREVEIL Spearphishing Delivers C2

Before executing its primary functions, RUSTCLOAK checks the infected machine against a list of over 100100 known sandbox environments to evade analysis.

Once the system is confirmed safe, the loader initiates a triple-layer decryption process to unpack the final payload. This sequence involves a custom RC4 decryption, Base64 decoding, and a final SM4-CBC decryption.

To further avoid detection, RUSTCLOAK completely bypasses traditional thread creation. Instead, it allocates memory and copies the decrypted shellcode using Windows fibers.

This technique allows the loader to transfer execution to the embedded executable an approximately 103103 KB file entirely in memory without writing the final payload to the disk.

According to Seqrite research, AZUREVEIL, is a heavily modified Adaptix C2 agent capable of executing 3636 different post-exploitation commands.

It grants the attacker extensive control over the infected system, enabling file system operations, process manipulation, lateral movement, and the execution of Beacon Object Files (BOFs) directly in memory.

Instead of relying on a traditional command-and-control server, AZUREVEIL abuses Microsoft Azure Blob Storage for communication.

The malware uses a dead-drop approach, in which the attacker and the infected system never interact directly. For example, the AZUREVEIL agent periodically uploads a tiny, encrypted beacon to a shared Azure container to signal its activity.

The attacker then places encrypted commands in that same container for the agent to retrieve, execute, and return results.

Because the traffic flows through legitimate Microsoft infrastructure over standard HTTPS, it easily blends in with normal enterprise network activity.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.