HazyBeacon Abuses AWS Lambda URLs for Stealthy C2 Relays

Key Takeaways

• A cyber-espionage group, CL-STA-1020 (dubbed HazyBeacon), is actively targeting government networks in Southeast Asia.
• The campaign leverages misconfigured AWS Lambda Function URLs as stealthy command-and-control (C2) relays.
• Attackers exploit stolen AWS Identity and Access Management (IAM) credentials to deploy malicious Lambda functions.
• The technique allows C2 traffic to blend seamlessly with legitimate AWS network activity, making detection extremely challenging.
• Defenders must prioritize robust IAM practices, comprehensive logging, and careful monitoring of cloud configurations.

A sophisticated cyber-espionage operation, identified as CL-STA-1020 and dubbed HazyBeacon, is reportedly compromising government entities across Southeast Asia. This advanced persistent threat (APT) campaign distinguishes itself by weaponizing legitimate AWS Lambda Function URLs, transforming them into stealthy command-and-control (C2) communication channels.

Researchers at Qualys Security have observed HazyBeacon exploiting misconfigured serverless features and compromised cloud credentials. This strategy allows malicious network traffic to masquerade as benign activity within trusted AWS infrastructure, significantly complicating detection efforts for conventional security tools.

Historically, malware relied on attacker-controlled servers for C2, which could often be identified and blocked using IP or domain reputation lists. HazyBeacon, however, exemplifies a critical evolution towards cloud-native C2, where adversaries embed their operational infrastructure directly within legitimate cloud environments. In this specific campaign, compromised systems communicate with AWS-hosted Lambda Function URLs.

This approach means that C2 traffic flows through established and trusted AWS domains. Consequently, it often appears innocuous to most network security solutions, effectively bypassing traditional defensive layers.

HazyBeacon Exploits AWS Lambda Function URLs

The core of the HazyBeacon attack involves the abuse of AWS Lambda Function URLs configured with AuthType: NONE. This specific setting permits public, unauthenticated access to the function’s endpoint.

These Function URLs offer a direct HTTPS interface to Lambda functions without requiring additional services like API Gateway or load balancers, thereby reducing operational overhead for attackers and simultaneously diminishing visibility for defenders.

Attackers initiate the process by compromising and leveraging stolen IAM credentials to create new Lambda functions within the victim’s AWS accounts. They then configure public Function URLs for these newly deployed functions, using them as proxies to relay encrypted communications from their malware to attacker-controlled infrastructure.

A typical malicious endpoint would resemble https://<function-name>.lambda-url.<region>.on.aws. The presence of the trusted “on.aws” domain makes this traffic appear legitimate, creating a significant “lookalike” problem for security teams attempting to differentiate between legitimate and malicious cloud activity.

HazyBeacon operates on a “borrowed-infrastructure” model, where threat actors weaponize third-party cloud environments for their objectives. The attack chain typically unfolds through several key stages:

• Credential Compromise: Initial access is gained through the theft of AWS IAM keys, often sourced from publicly exposed repositories or sophisticated phishing campaigns.
• Infrastructure Deployment: Using the stolen credentials, attackers programmatically create Lambda functions via legitimate AWS APIs.
• Relay Setup: Public Function URLs are subsequently enabled for these Lambda functions, establishing them as communication relays for command transmission.
• C2 Communication: The deployed malware on compromised systems sends encrypted requests to these Lambda Function URLs. The Lambda function then forwards these requests to attacker-controlled servers and relays responses back to the infected host.

As documented in research published by Qualys, this methodology ensures that communications from infected systems to the true attacker infrastructure are masked by legitimate AWS Lambda relays, effectively concealing the actual C2 destination behind a facade of normal cloud traffic.

HazyBeacon itself functions as a lightweight backdoor, capable of profiling target systems, executing arbitrary remote commands, and exfiltrating sensitive data, including documents and keystrokes. The attackers leverage AWS Lambda to obscure their communications within normal cloud traffic, primarily by exploiting weak identity and configuration management practices rather than any inherent vulnerabilities in AWS itself.

What You Should Do

• Strengthen IAM Hygiene: Implement and enforce robust IAM policies, including mandatory multi-factor authentication (MFA) for all users and frequent rotation of IAM access keys. Regularly audit IAM roles and permissions.
• Enable Comprehensive Logging: Ensure AWS CloudTrail logging is activated across all AWS regions to capture and monitor all API activity. This is crucial for detecting unauthorized Lambda function creation or modification.
• Monitor Network Flows: Analyze VPC flow logs to identify unusual traffic patterns, particularly those that might indicate proxy-like behavior or unexpected communication from Lambda functions.
• Implement Service Control Policies (SCPs): Utilize AWS SCPs to restrict the creation of Lambda Function URLs with public access (AuthType: NONE) across your organization, unless explicitly justified and approved by security teams.
• Track Cost Anomalies: Monitor AWS billing and cost explorer for unexpected spikes in Lambda invocation costs, which could signal large-scale C2 relay operations by attackers.
• Continuous Configuration Monitoring: Regularly audit AWS configurations to ensure no public access is inadvertently granted to sensitive resources, including Lambda functions.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.