HazyBeacon Campaign Abuses AWS for Covert Communications

Key Takeaways

• A new malware campaign, dubbed HazyBeacon (CL-STA-1020), is leveraging Amazon Web Services (AWS) Lambda Function URLs for covert command and control (C2) communications.
• The campaign primarily targets government entities in Southeast Asia.
• HazyBeacon exploits compromised AWS accounts, not vulnerabilities within AWS itself, to establish stealthy communication relays that appear as legitimate AWS traffic.
• The malware functions as a backdoor, exfiltrating system information, documents, and keystrokes, and executing arbitrary commands.
• Detection and mitigation rely heavily on robust AWS Identity and Access Management (IAM) hygiene, comprehensive CloudTrail logging, and careful monitoring of Lambda function configurations and billing anomalies.

A sophisticated new malware operation, identified as HazyBeacon and tracked under the cluster identifier CL-STA-1020, is actively exploiting legitimate cloud infrastructure for clandestine command and control (C2) activities. This campaign predominantly targets government networks across Southeast Asia, as detailed in a recent report.

Unlike traditional malware that relies on easily identifiable or blockable servers, HazyBeacon leverages Amazon Web Services (AWS), one of the world’s most trusted cloud platforms, to obscure its communications. This tactic makes its malicious traffic appear as routine, encrypted HTTPS connections to Amazon’s own services, effectively blending in with legitimate network activity.

The campaign’s distinctive approach involves compromising AWS accounts belonging to unrelated organizations. Within these hijacked accounts, threat actors deploy lightweight serverless functions, which then act as hidden relay points for their C2 infrastructure. Researchers at Qualys outlined in a report shared with Cyber Security News (CSN) that this campaign was initially documented by Palo Alto Networks Unit 42 in July 2025. The Qualys analysis offers a comprehensive breakdown of the technical mechanisms involved and provides actionable strategies for defenders to detect and neutralize this cloud-native threat.

HazyBeacon’s Modus Operandi

Once HazyBeacon successfully infiltrates a victim’s Windows machine, it establishes itself as a discreet backdoor. Its primary functions include gathering critical system information, such as hostname, IP address, and user privilege levels. The malware is designed to receive encrypted commands, enabling it to execute arbitrary shell instructions or download additional malicious payloads. It also silently exfiltrates stolen documents and captured keystrokes back to the attackers.

Crucially, the HazyBeacon campaign does not exploit inherent vulnerabilities within AWS itself. Instead, attackers obtain static AWS Identity and Access Management (IAM) access keys, often stolen from exposed GitHub repositories or through targeted phishing campaigns. These compromised keys are then used to construct the malicious relay within an already breached cloud account.

HazyBeacon Campaign Weaponizes Amazon Web Services

The core of this attack vector lies in the abuse of AWS Lambda Function URLs, a feature introduced in April 2022. These URLs provide a direct internet endpoint for serverless functions, eliminating the need for additional services like API Gateway. While this simplicity is beneficial for developers, it also presents an easy avenue for malicious actors to weaponize.

Lambda Function URLs offer two authentication modes: one requiring valid IAM credentials, and another, designated as AuthType: NONE, which permits unauthenticated requests. Attackers exploit the latter option to rapidly deploy a public HTTPS relay within AWS infrastructure. Because these endpoints resolve to domains ending in “on.aws,” the malicious traffic seamlessly integrates with legitimate Amazon service communications, making it difficult for security teams to differentiate.

The malicious relay operates as a silent intermediary. Malware on an infected machine sends an encrypted HTTP POST request to a Lambda URL hosted within a compromised AWS account. This Lambda function then strips the request headers and forwards the payload to the attacker’s true backend server. The response travels back along the same path. In most cases, neither the malware victim nor the owner of the compromised AWS account becomes aware of the breach until an abuse notification is received or an unexpected bill indicates unusual activity.

The attack chain typically begins with poor identity hygiene. Attackers validate stolen IAM keys through discreet API calls. Following validation, they upload a compressed Python or Node.js payload, deploying it as a Lambda function with an innocuous name, such as “UpdateWorker,” in a less-monitored AWS region to evade detection.

What You Should Do

• Strengthen IAM Hygiene: Implement strict policies for AWS Identity and Access Management (IAM). Disable all unused access keys, enforce regular key rotation, and mandate multi-factor authentication (MFA) across all cloud accounts. This directly addresses the primary entry point for HazyBeacon.
• Enable Comprehensive CloudTrail Logging: Ensure AWS CloudTrail logging is enabled across all regions. CloudTrail records every API call, including the creation and modification of Lambda functions and Function URLs, providing crucial visibility into unauthorized deployments.
• Implement Service Control Policies (SCPs): At the AWS Organization level, apply SCPs to restrict the creation of Lambda Function URLs configured with AuthType: NONE. If such configurations are essential, ensure they are explicitly approved and tagged.
• Route Lambda Workloads Through VPCs: Where possible, route Lambda workloads through a Virtual Private Cloud (VPC). This allows for monitoring of network flow logs, which can reveal anomalous one-to-one inbound-to-outbound traffic patterns indicative of a relay.
• Monitor Billing Anomalies: Set up granular AWS budget alerts to detect unusual cost spikes, particularly in non-production or less-utilized regions. A high volume of Lambda invocations, especially in unexpected areas, can signal a compromised account being used as a C2 relay.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.