Hackers Use Spearphishing to Deploy AZUREVEIL Adaptix C2 Agent

Hackers are actively deploying a sophisticated malware framework dubbed AZUREVEIL, an Adaptix-based command-and-control (C2) agent, through a targeted spearphishing campaign aimed at government and enterprise sectors in the Czech Republic and Taiwan.

The attack begins with a malicious ZIP archive delivered via spearphishing emails. The archive contains files disguised as official documents, including a shortcut file masquerading as a PDF and a Rust-based executable.

These files mimic government communications, increasing the likelihood of user interaction, particularly among public sector targets.

Analysis shows that the campaign uses region-specific lures. Traditional Chinese filenames and decoy content suggest targeting in Taiwan.

At the same time, a Czech-language document impersonates the Czech Social Security Administration, reinforcing the dual geographic focus.

The campaign, uncovered by Seqrite’s APT Team, highlights advanced tradecraft, multi-stage execution chains, and abuse of legitimate cloud infrastructure for stealthy operations.

The decoy documents are designed to distract victims while malicious processes execute silently in the background.

Once the archive is opened, the infection chain can proceed through two execution paths. In the first path, a malicious LNK file triggers a hidden VBScript, which launches a PowerShell script.

AZUREVEIL Adaptix C2 Agent

This script decrypts an XOR-encrypted payload stored in a file named 1.dat and executes it as RuntimeBroker_update.exe. In the second path, a standalone executable performs all actions internally, dropping and executing the same payload without external dependencies.

Both paths converge at a DLL sideloading stage, where a legitimate executable loads a malicious UnityPlayer.dll. This DLL, identified as a Rust-based loader named RUSTCLOAK, initiates further payload decryption and execution.

The loader employs anti-analysis techniques, including checking system names against known sandbox environments, ensuring it avoids detection during automated analysis.

A notable feature of the campaign is its multi-layered encryption approach. The payload undergoes three stages of decryption, combining a custom RC4 algorithm, Base64 decoding, and SM4-CBC encryption.

This layered design significantly complicates static and dynamic analysis while evading traditional security controls.

The final payload, AZUREVEIL, operates entirely in memory and is deployed as a 64-bit DLL. It leverages advanced techniques such as dynamic API resolution using hashing and execution via Windows fibers, avoiding common detection mechanisms associated with thread-based execution.

One of the most distinctive aspects of the campaign is its use of Microsoft Azure Blob Storage as a dead-drop C2 channel. Instead of communicating with a traditional command server, the malware exchanges data through a shared Azure storage container.

Infected systems upload encrypted beacon data, while attackers place commands in the same storage location. This method allows malicious traffic to blend seamlessly with legitimate cloud activity, making detection significantly more challenging.

The AZUREVEIL agent supports extensive post-exploitation capabilities, including file exfiltration, process control, network pivoting, and in-memory execution of Beacon Object Files.

These features enable attackers to maintain persistence, move laterally, and execute arbitrary code without writing additional files to disk.AZUREVEIL is a fully featured Adaptix C2 agent compiled as a 64-bit DLL using MinGW C++.

Researchers also identified a long-lived Shared Access Signature (SAS) token embedded in the malware, granting full access to the Azure storage account for nearly a year. This indicates a deliberate effort to maintain persistent and covert access to compromised environments.

Based on observed tactics, techniques, and procedures, along with targeting patterns, the campaign is assessed to be linked to a China-aligned threat actor.

However, researchers have not attributed it to a specific known group, suggesting potential evolution in tooling or a previously undocumented operation.

Security teams are advised to monitor for suspicious use of cloud services, especially Azure Blob Storage interactions, and to detect unusual script execution chains involving LNK, VBScript, and PowerShell.

Blocking unauthorized DLL sideloading and inspecting encrypted payload delivery mechanisms can further reduce risk from such advanced campaigns.

Indicators of Compromise (IOCs)

SHA-256
096372d19b4787e989f44e04c5ecc29885aa927c34ae8666628d6c0eb20bb447	計畫申請審查結果通知單.pdf.lnk
1c56228cbd1bdebb9e5ea55c2749150fee06c865ede4a3754e8bd6843e51d2d4	計畫申請審查結果通知單.exe
080ab9bc2893ba7bad354551604a667af40ed2ae2d042d2323c2bd9ad3122192	UnityPlayer.dll
5ed14c2b7f7433a1a72dd6b668413f935a217ba10b69d89b774a82990fa12fe1	BrowserViewUtility.exe
61f7d9cd2d8ce7df950639b23ce90085b300b0c6dd0d8d934bba8fdecb670f15	RuntimeBroker_update.exe
24aa4e780ccd66cef13da9ef98c32954105cf2a32ec643efab0ba1aa2d6352f4	Com.dat
02542a49b3bd6bd2795afb67840acb4557b17e017f7503dd03ebe3aeeb28720e	000b67d70f3876965bb09fd37164b7ccrezervaci.pdf
8ae7c82a3e4f742777e590b25a1c563d19bd9bcba2a387d004aae72c4b2828f9	000b67d70f3876965bb09fd37164b7.pdf
047687548605734348792e2a9d771b6cba42facd0d0d7d44d778290a25848574	1.dat
a4e9f9919d62589b57cfa08c9ccb89e386b09f683271373413cd8e8c8c7d1c5a	empty.vbs
823d5969db3f3b72ebbdce1b78752717ea849884a0fb40d86146416c38e128de	Profile.ps1
783661d0f7edb338d2d50be087764d82dbbc9ee7989ddc57db1801e4ec9045b0	azureveil.exe

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.