Chinese Espionage Campaign Targets the Czech Republic — Operation Dragon Weave

Researchers at Seqrite Labs have uncovered a new cyber-espionage campaign, codenamed Operation Dragon Weave, targeting officials and citizens in the Czech Republic and Taiwan. The affected sectors include government administration, research and academia, technology companies, and financial services.

The attack begins with a spear-phishing email carrying a ZIP attachment. Once unpacked, the archive contains files that appear legitimate at first glance, but in reality form a structured infection chain that executes malicious code in the background.

A notable feature of the campaign is that the attackers prepared two independent infection paths that converge on the same payload. In the first variant, the victim opens a malicious LNK file disguised with a double extension as a PDF document; it covertly launches a VBScript, which hands control over to a PowerShell script. The script uses a simple XOR operation to decrypt the file 1.dat, from which it creates and executes RuntimeBroker_update.exe.

In the second variant, the victim runs a binary directly from the archive — a standalone dropper written in Rust that carries all the components within itself.

In both cases, this is followed by DLL side-loading of a counterfeit UnityPlayer.dll library and the deployment of a Rust loader named RUSTCLOAK. Before executing the payload, it checks the computer name against a list of more than a hundred known sandbox machines and terminates immediately if a match is found.

The final payload is AZUREVEIL, a fully featured agent of the open-source AdaptixC2 framework. Its most interesting trait is how it communicates with its command infrastructure: the malware uses no traditional C2 server, but instead a so-called dead drop approach via Microsoft Azure Blob Storage. The attacker and the infected system never communicate directly, so the traffic blends into ordinary communication with a legitimate cloud service on port 443.

Particularly relevant for the Czech context is a lure imitating a document from the Czech Social Security Administration (ČSSZ). The decoy PDF, embedded directly in the executable, looks like an official confirmation of a booked appointment at the office, complete with the name of a fictitious person, the appointment date, instructions for collecting a queue ticket, and a link to the official website cssz[.]cz.

Are you sure your systems are secure?

Every week we bring examples of attacks and vulnerabilities that can affect anyone. If you’re not sure whether your infrastructure is resilient, we’d be glad to help you find out. At SysNetShield we offer vulnerability scanning, penetration testing, Red Teaming, and phishing campaign simulations.

Get in touch — the first consultation or a vulnerability scan of a single domain/IP address is free.

A Single Malicious Issue Was Enough to Take Over a Repository: Vulnerability in the Claude Code GitHub Action

Security researcher RyotaK of the Japanese company GMO Flatt Security discovered a vulnerability in Anthropic’s Claude Code GitHub Action tool that allowed an attacker to take control of vulnerable public repositories. All it took was a single GitHub issue.

Claude Code GitHub Actions embeds Claude directly into the CI/CD pipeline, where it triages issues, assigns labels, reviews pull requests, or runs slash commands. By default, the workflow has both read and write access to the repository’s code, issues, pull requests, discussions, and workflow files.

Because these permissions are broad, the Action is supposed to strictly verify who is allowed to trigger it. However, the trigger check (the checkWritePermissions function) contained a flaw: it unconditionally let through any user whose name ended in [bot], based on the assumption that GitHub Apps are trustworthy tools installed by administrators.

The problem is that anyone can register a GitHub App, install it on their own repository, and use its token to open an issue or pull request on any public repository. The Action saw a “bot” and let the attacker’s content through.

RyotaK reported the core of the problem (a permission bypass) to Anthropic on January 12, 2026, and the company fixed it within four days; additional hardening patches were added over the spring, and all of them are included in claude-code-action version v1.0.94.

Anthropic rated the vulnerability with a score of 7.8 under CVSS v4.0 and, as part of its bug bounty program, paid out USD 3,800 plus a USD 1,000 bonus.

Critical Netlogon Vulnerability (CVE-2026–41089): Domain Controllers Under Active Attack

Microsoft has disclosed a flaw tracked as CVE-2026–41089, rated CVSS 9.8, which affects all supported versions of Windows Server configured as domain controllers and allows attackers to achieve remote code execution with SYSTEM privileges through the Netlogon RPC interface.

At a technical level, the attack is very simple. The attacker only needs network access to the Netlogon service of a vulnerable domain controller. By sending a specially crafted network request, they trigger faulty processing within the service and achieve execution of arbitrary code with SYSTEM privileges. No prior authentication, local access, or user interaction is required, which makes the flaw an ideal candidate for automated exploitation, lateral movement, and rapid domain compromise.

All versions from Windows Server 2012 through Windows Server 2025 are affected.

Microsoft published the flaw on May 12, 2026, crediting its internal offensive team, Windows Attack Research & Protection (WARP), with the discovery.

Cisco Catalyst SD-WAN Manager: Another Actively Exploited Zero-Day With No Patch

Cisco has warned of a high-severity vulnerability in its Catalyst SD-WAN Manager product (formerly known as SD-WAN vManage) that is already being actively exploited by attackers. The flaw, tracked as CVE-2026–20245 and rated CVSS 7.8, resides in the SD-WAN Manager command-line interface.

Due to insufficient validation of user-supplied input, an attacker can upload a specially crafted file, trigger command injection, and escalate their privileges all the way to root.

An important detail is that this is not a remote unauthenticated flaw. To exploit it, the attacker must hold netadmin privileges on the target system, which means either valid credentials or a prior compromise through one of the previously disclosed vulnerabilities — the attacks have leveraged CVE-2026–20182 or CVE-2026–20127.

No fix or workaround exists yet. Cisco’s PSIRT security team learned of the exploitation in June 2026, when the flaw was reported by Mandiant.

CVE-2026–20245 is already the seventh vulnerability in the Cisco SD-WAN product line to be flagged as actively exploited this year. This series is no coincidence: Cisco Talos is tracking, under the designation UAT-8616, a highly sophisticated actor whose activity dates back to at least 2023 and who primarily targets critical infrastructure sectors.