Dragon Weave - Azure Blob Storage Dead-Drop C2

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•3

Flags outbound HTTPS traffic to a specific Azure Blob Storage path ('note1ggbbhggdwa1.blob.core.windows.net/note/ats/') when initiated by 'RuntimeBroker_update.exe'. This pattern is indicative of a dead-drop command and control (C2) mechanism, potentially associated with the 'Operation Dragon Weave' campaign.