Operation Dragon Weave: Windows Malware Uses Azure Blob Storage for Covert Command and Control

From document disguise to remote control​

Seqrite describes Traditional Chinese document-style filenames and a Czech Social Security Administration appointment decoy. Two execution paths converge: a .pdf.lnk shortcut launches VBScript and PowerShell, while a Rust dropper extracts components directly. Both reach DLL sideloading through RuntimeBroker_update.exe and malicious UnityPlayer.dll.

The RUSTCLOAK loader checks more than 100 analysis-system names, applies layered payload decryption, and executes through Windows fibers. Its final payload, AZUREVEIL, is a 64-bit Adaptix agent supporting 36 commands, including remote execution, exfiltration, network discovery, proxying and in-memory Beacon Object Files.

For command-and-control, infected devices and operators exchange encrypted blobs through Azure storage. Seqrite found an embedded Shared Access Signature token with broad permissions and validity spanning March 19, 2026, to March 19, 2027. Those dates do not establish that the infrastructure remains operational.

Azure abuse is not an Azure vulnerability​

The important distinction is between abusing a service and compromising its underlying platform. Microsoft documents Shared Access Signatures, or SAS tokens, as a normal mechanism for granting delegated storage access with defined resources, permissions and expiry times. Possessing an authorized token allows a client to make permitted requests; the mechanism itself does not imply an authentication bypass.

The defensive lesson is therefore not “Azure traffic is malicious.” It is that a legitimate destination cannot establish whether the originating activity is legitimate. Applied to this campaign, that means assessing storage access alongside the endpoint behavior that preceded it, rather than treating a familiar cloud hostname as an automatic clean bill of health. This is a defensive inference from the reported execution chain and Microsoft’s documented authorization model.

There is a separate lesson for organizations managing their own Azure storage. Microsoft recommends minimum necessary SAS permissions, short validity periods, a revocation plan and user-delegation SAS where possible. It also warns that anyone obtaining a leaked SAS can use it. These measures protect an organization’s storage; they do not, by themselves, prevent an endpoint from contacting an attacker’s external storage account.

Windows fibers are not an invisibility cloak​

Microsoft’s Windows documentation supplies useful context for RUSTCLOAK’s execution technique: fibers are application-scheduled execution units that run within threads. From the operating system’s perspective, a fiber’s operations belong to the thread running it. Fibers are legitimate Windows functionality, not inherently malicious.

The practical interpretation is narrower than “threadless malware.” Avoiding creation of a new thread does not mean execution has escaped the Windows threading model. Defenders should not treat the absence of a conventional new-thread event as proof that no suspicious code ran. That conclusion follows from Microsoft’s documented fiber behavior, rather than from any claim of firsthand testing of AZUREVEIL.

Controls worth evaluating​

For Windows administrators, Microsoft’s attack surface reduction documentation identifies several relevant controls:

• Block executable content from email client and webmail
• Block execution of potentially obfuscated scripts
• Block JavaScript or VBScript from launching downloaded executable content

Microsoft lists these rules as supported on Windows 11, with Windows Server support varying by rule and release. Administrators should check the specific rule’s prerequisites against their deployed systems. These are relevant control candidates—not evidence that every delivery path in Dragon Weave would be blocked.

That distinction matters. A documented security feature is not the same thing as a validated detection for a particular sample. The sound takeaway is to combine delivery controls, endpoint investigation and cloud-access scrutiny—not to expect a single checkbox, a familiar Microsoft hostname or the word “fileless” to settle the case. That layered approach is the practical inference supported by the campaign’s multiple execution paths and Microsoft’s behavior-focused protections.