Government Organizations Targeted via AWS Lambda URL Endpoint Exploits

Unit 42 researchers from Palo Alto Networks have been monitoring a sophisticated threat cluster designated CL-STA-1020, which has been systematically targeting governmental entities across Southeast Asia.

This operation focuses on extracting sensitive data from government agencies, particularly details surrounding recent tariffs and trade disputes, underscoring a motive rooted in espionage and intelligence gathering.

The campaign stands out for its innovative use of a previously undocumented Windows backdoor, dubbed HazyBeacon, which exploits AWS Lambda URLs to establish a stealthy command-and-control (C2) infrastructure.

Novel Backdoor Emerges

By leveraging legitimate AWS serverless functions invoked via HTTPS endpoints, the threat actors create a scalable, resilient communication channel that blends seamlessly with benign cloud traffic, evading traditional network defenses.

This technique, first highlighted by Trellix in June 2025 in relation to advanced persistent threat (APT) activities, allows malicious operations to masquerade as routine AWS interactions, complicating detection in environments with heavy cloud dependencies.

The attack chain begins with DLL sideloading, where adversaries deploy the malicious mscorsvc.dll in the C:\Windows\assembly directory alongside the legitimate Microsoft executable mscorsvw.exe.

Upon execution via its associated Windows service, the sideloaded DLL initiates beaconing to an attacker-controlled AWS Lambda URL, such as those resolving to lambda-url.ap-southeast-1.on.aws subdomains.

Persistence is achieved through the creation of a custom Windows service named msdnetsvc, ensuring the backdoor reactivates post-reboot.

Once connected, HazyBeacon downloads additional payloads to C:\ProgramData, including legitimate tools like 7z.exe for file archiving and custom utilities for data collection and exfiltration.

For instance, the igfx.exe payload serves as a file collector, scanning for specified extensions within defined time ranges and compressing results into ZIP archives named after the compromised machine.

These archives are then split into 200 MB chunks using 7z.exe, facilitating targeted reconnaissance for documents related to trade disputes, such as searches for “letter to US President on Tariffs measures.”

Exfiltration Tactics

Exfiltration efforts further demonstrate the actors’ emphasis on blending with legitimate traffic, employing custom tools like GoogleGet.exe for authenticating to Google Drive repositories via provided drive IDs, followed by uploaders such as google.exe, GoogleDrive.exe, and GoogleDriveUpload.exe for transferring collected data.

Similarly, Dropbox.exe handles uploads to Dropbox, routing exfiltrated files through trusted cloud storage services to mimic normal enterprise activity.

According to the Report, Although these attempts were detected and blocked in monitored environments, the operation concludes with cleanup commands that erase payloads, archives, and traces, minimizing forensic footprints.

This abuse of AWS Lambda, introduced in 2022 for direct HTTPS function invocation without API Gateway overhead, provides tactical advantages including dynamic C2 without persistent servers, exploiting the ubiquity of amazonaws.com domains in legitimate traffic.

The campaign exemplifies how adversaries repurpose cloud-native features for malice, prompting security teams to enhance monitoring of anomalous cloud communications and adopt behavioral analytics for detecting deviations in serverless interactions.

Indicators of Compromise