Hackers Use Spearphishing to Deploy AZUREVEIL Adaptix C2 Agent

Hackers are actively deploying a sophisticated malware framework dubbed AZUREVEIL, an Adaptix-based command-and-control (C2) agent, through a targeted spearphishing campaign aimed at government and enterprise sectors in the Czech Republic and Taiwan.

The attack begins with a malicious ZIP archive delivered via spearphishing emails. The archive contains files disguised as official documents, including a shortcut file masquerading as a PDF and a Rust-based executable.

These files mimic government communications, increasing the likelihood of user interaction, particularly among public sector targets.

Analysis shows that the campaign uses region-specific lures. Traditional Chinese filenames and decoy content suggest targeting in Taiwan.

At the same time, a Czech-language document impersonates the Czech Social Security Administration, reinforcing the dual geographic focus.

The campaign, uncovered by Seqrite’s APT Team, highlights advanced tradecraft, multi-stage execution chains, and abuse of legitimate cloud infrastructure for stealthy operations.

The decoy documents are designed to distract victims while malicious processes execute silently in the background.

Once the archive is opened, the infection chain can proceed through two execution paths. In the first path, a malicious LNK file triggers a hidden VBScript, which launches a PowerShell script.

AZUREVEIL Adaptix C2 Agent

This script decrypts an XOR-encrypted payload stored in a file named 1.dat and executes it as RuntimeBroker_update.exe. In the second path, a standalone executable performs all actions internally, dropping and executing the same payload without external dependencies.

Both paths converge at a DLL sideloading stage, where a legitimate executable loads a malicious UnityPlayer.dll. This DLL, identified as a Rust-based loader named RUSTCLOAK, initiates further payload decryption and execution.

The loader employs anti-analysis techniques, including checking system names against known sandbox environments, ensuring it avoids detection during automated analysis.

A notable feature of the campaign is its multi-layered encryption approach. The payload undergoes three stages of decryption, combining a custom RC4 algorithm, Base64 decoding, and SM4-CBC encryption.

This layered design significantly complicates static and dynamic analysis while evading traditional security controls.

The final payload, AZUREVEIL, operates entirely in memory and is deployed as a 64-bit DLL. It leverages advanced techniques such as dynamic API resolution using hashing and execution via Windows fibers, avoiding common detection mechanisms associated with thread-based execution.

One of the most distinctive aspects of the campaign is its use of Microsoft Azure Blob Storage as a dead-drop C2 channel. Instead of communicating with a traditional command server, the malware exchanges data through a shared Azure storage container.

Infected systems upload encrypted beacon data, while attackers place commands in the same storage location. This method allows malicious traffic to blend seamlessly with legitimate cloud activity, making detection significantly more challenging.

The AZUREVEIL agent supports extensive post-exploitation capabilities, including file exfiltration, process control, network pivoting, and in-memory execution of Beacon Object Files.

These features enable attackers to maintain persistence, move laterally, and execute arbitrary code without writing additional files to disk.AZUREVEIL is a fully featured Adaptix C2 agent compiled as a 64-bit DLL using MinGW C++.

Researchers also identified a long-lived Shared Access Signature (SAS) token embedded in the malware, granting full access to the Azure storage account for nearly a year. This indicates a deliberate effort to maintain persistent and covert access to compromised environments.

Based on observed tactics, techniques, and procedures, along with targeting patterns, the campaign is assessed to be linked to a China-aligned threat actor.

However, researchers have not attributed it to a specific known group, suggesting potential evolution in tooling or a previously undocumented operation.

Security teams are advised to monitor for suspicious use of cloud services, especially Azure Blob Storage interactions, and to detect unusual script execution chains involving LNK, VBScript, and PowerShell.

Blocking unauthorized DLL sideloading and inspecting encrypted payload delivery mechanisms can further reduce risk from such advanced campaigns.

Indicators of Compromise (IOCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.