HazyBeacon
HazyBeacon is a previously undocumented lightweight Windows backdoor associated with the activity cluster CL-STA-1020. It has been reported targeting governmental organizations and government networks in Southeast Asia, with reporting assessing the campaign as focused on covert intelligence collection, including sensitive information related to tariffs and trade disputes. The malware uses AWS Lambda Function URLs as command-and-control infrastructure, causing beaconing and tasking traffic to blend in with legitimate encrypted HTTPS communications to Amazon infrastructure, including on.aws domains. Reporting states the operators abused compromised AWS accounts and public Lambda Function URLs configured with AuthType: NONE as relays rather than exploiting vulnerabilities in AWS itself.
On infected Windows systems, HazyBeacon collects host information including hostname, IP address, and user privileges, receives encrypted commands, executes shell instructions, downloads additional payloads, and uploads stolen documents and captured keystrokes. Reported delivery and execution included DLL sideloading, with a malicious mscorsvc.dll placed at C:\Windows\assembly\mscorsvc.dll and loaded by the legitimate mscorsvw.exe process. Persistence was established via a Windows service named msdnetsvc. One reported C2 endpoint pattern was a Lambda URL in the ap-southeast-1 region ending in lambda-url.ap-southeast-1.on.aws.
The malware was also reported downloading follow-on tooling into C:\ProgramData, including 7z.exe, a file collector named igfx.exe, GoogleGet.exe, multiple custom Google Drive uploaders (google.exe, GoogleDrive.exe, GoogleDriveUpload.exe), and a Dropbox uploader (Dropbox.exe). The file collector reportedly accepted a time range and file extensions and created ZIP archives named after the victim machine, while 7-Zip was used to split archives into 200 MB chunks. Operators conducted targeted searches for trade-related documents, including the query "letter to US President on Tariffs measures," and attempted exfiltration via Google Drive and Dropbox. Reported cleanup activity included deletion of created archives and payloads after exfiltration attempts were blocked.
High-confidence indicators and artifacts mentioned in the reporting include the malware name HazyBeacon; cluster identifier CL-STA-1020; malicious DLL path C:\Windows\assembly\mscorsvc.dll; legitimate loader mscorsvw.exe; persistence service msdnetsvc; staging directory C:\ProgramData; payload names 7z.exe, igfx.exe, GoogleGet.exe, google.exe, GoogleDrive.exe, GoogleDriveUpload.exe, and Dropbox.exe; and Lambda URL C2 infrastructure using on.aws domains.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Techniques & procedures
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 techniqueAttackers compromise AWS accounts belonging to unrelated organizations and plant lightweight serverless functions inside them as hidden relay points.
Initial Access
2 techniquesAttackers validate stolen keys with quiet API calls, upload a zipped Python or Node.js payload as a Lambda function with a benign name like “UpdateWorker,” and deploy it in a low-scrutiny AWS region to avoid detection.
Attackers steal static IAM access keys from exposed GitHub repositories or phishing campaigns, then use those keys to build a relay inside a compromised cloud account.
Execution
2 techniquesIt receives encrypted commands to run shell instructions or pull down further payloads.
The core of this attack is the abuse of AWS Lambda Function URLs... Attackers choose this option to spin up a public HTTPS relay inside AWS infrastructure within seconds.
Persistence
1 techniquePrivilege Escalation
1 techniqueStealth
1 techniqueCredential Access
2 techniquesIt silently uploads stolen documents and captured keystrokes to the attackers.
Attackers steal static IAM access keys from exposed GitHub repositories or phishing campaigns, then use those keys to build a relay inside a compromised cloud account.
Discovery
1 techniqueOnce HazyBeacon installs on a victim’s Windows machine, it works as a lightweight backdoor. It collects system details like hostname, IP address, and user privileges.
Collection
1 techniqueCommand and Control
3 techniquesTo any security team watching traffic, the communications look like routine, encrypted HTTPS connections to Amazon’s own infrastructure.
The relay works as a silent middleman. Malware sends an encrypted HTTP POST to a Lambda URL inside a different compromised AWS account. That function strips the headers and forwards the payload to the attacker’s real backend server, which responds through the same path.
It receives encrypted commands to run shell instructions or pull down further payloads.
Exfiltration
1 techniqueIt silently uploads stolen documents and captured keystrokes to the attackers.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A lightweight Windows backdoor used in a campaign targeting government networks in Southeast Asia. It collects host details, receives encrypted commands to execute shell instructions or download additional payloads, and uploads stolen documents and captured keystrokes. Its command-and-control traffic is relayed through attacker-abused AWS Lambda Function URLs hosted in compromised AWS accounts.
State-backed Windows backdoor using AWS Lambda for data theft from Southeast Asian government targets (per summary).
Previously undocumented Windows backdoor deployed via DLL sideloading (malicious mscorsvc.dll loaded by legitimate mscorsvw.exe) that uses AWS Lambda Function URLs for HTTPS C2. It beacons to an actor-controlled *.lambda-url.*.on.aws endpoint, receives commands, and downloads additional payloads used for file collection, archiving/splitting, and exfiltration via legitimate cloud storage services (Google Drive, Dropbox). Persistence is established via a Windows service (msdnetsvc).
A Windows backdoor used in state-backed cyber espionage campaigns to steal sensitive data from Southeast Asian government agencies, leveraging AWS Lambda for data exfiltration.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.