Behind the Clouds: Attackers Targeting Governments in Southeast Asia Implement Novel Covert C2 Communication
Summary: Since late 2024, Unit 42 has tracked a cluster of activity it calls CL-STA-1020, targeting government entities in Southeast Asia and collecting sensitive information including material on recent tariffs and trade disputes. The actors deployed a previously undocumented Windows backdoor named HazyBeacon, which used AWS Lambda URLs as command-and-control infrastructure and was installed via DLL sideloading of a malicious mscorsvc.dll alongside the legitimate mscorsvw.exe, with persistence through a Windows service named msdnetsvc.
Bottom line: The C2 traffic rode on amazonaws.com and on.aws domains that enterprises routinely allow, and the exfiltration attempts used Google Drive and Dropbox, so the campaign's main defense was looking like normal business traffic. The stolen material concerned trade disputes and tariffs, which puts the intelligence loss in policy terms rather than just network terms.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026