Covert Espionage: State-Backed Actors Deploy HazyBeacon in SEA Campaign
- SHAH MUHAMMAD ASH-SYAFIQ BIN SHAHRIL
- Jul 21
- 2 min read
๐ฃ๐ฎ๐น๐ผ ๐๐น๐๐ผ ๐ก๐ฒ๐๐๐ผ๐ฟ๐ธ๐โ ๐จ๐ป๐ถ๐ ๐ฐ๐ฎ has uncovered a new state-backed cyber espionage campaign dubbed CL-STA-1020, actively ๐ต๐ข๐ณ๐จ๐ฆ๐ต๐ช๐ฏ๐จ ๐จ๐ฐ๐ท๐ฆ๐ณ๐ฏ๐ฎ๐ฆ๐ฏ๐ต๐ข๐ญ ๐ฃ๐ฐ๐ฅ๐ช๐ฆ๐ด in Southeast Asia. Central to this operation is a newly identified Windows backdoor named ๐๐ฎ๐๐๐๐ฒ๐ฎ๐ฐ๐ผ๐ป, believed to be leveraged by a state-aligned threat group with strong geopolitical motives.
This campaign primarily seeks intelligence related to tariff policies, trade negotiations, and regulatory decisionsโkey levers in the Southeast Asian regionโs strategic importance in U.S.โChina dynamics. The operation underlines the growing trend of leveraging legitimate cloud infrastructure to conduct stealthy cyber intrusions.
๐ ๐ง๐ง๐ฃ๐: ๐ง๐ฟ๐ฎ๐ฑ๐ฒ๐ฐ๐ฟ๐ฎ๐ณ๐ & ๐ง๐ฒ๐ฐ๐ต๐ป๐ถ๐ฐ๐ฎ๐น ๐๐ป๐๐ถ๐ด๐ต๐๐
While the initial access vector remains unconfirmed, telemetry suggests that HazyBeacon is delivered via DLL side-loading:
ย ย โข ๐งช Malicious mscorsvc.dll dropped alongside legitimate mscorsvw.exe
ย ย โข ๐ข Executed to initiate the HazyBeacon infection chain
ย ย โข ๐ฅ๏ธ Persistence via service registration (autostarts with reboot)
Once active, HazyBeacon establishes outbound C2 over AWS Lambda URLs, allowing:
ย ย โข ๐ Encrypted command execution via *.lambda-url.*.amazonaws.com
ย ย โข ๐ฆ Download of additional payloads, including a file collector module
ย ย โข ๐๏ธ Harvesting of sensitive file types (e.g., .doc, .xls, .pdf) modified within a specific time frame
ย ย โข โ๏ธ Exfiltration attempts via Dropbox and Google Drive
ย ย โข ๐งน Cleanup stage to remove artifacts and cover tracks
This technique of abusing cloud-native functions is an evolving tactic in modern APT operationsโknown as living-off-trusted-services (LOTS).
๐ ๐ข๐ฝ๐ฒ๐ฟ๐ฎ๐๐ถ๐ผ๐ป๐ฎ๐น ๐๐บ๐ฝ๐ฎ๐ฐ๐
The HazyBeacon campaign ๐ฝ๐ฟ๐ถ๐บ๐ฎ๐ฟ๐ถ๐น๐ ๐๐ฎ๐ฟ๐ด๐ฒ๐๐ ๐ด๐ผ๐๐ฒ๐ฟ๐ป๐บ๐ฒ๐ป๐ ๐บ๐ถ๐ป๐ถ๐๐๐ฟ๐ถ๐ฒ๐, ๐๐ฟ๐ฎ๐ฑ๐ฒ ๐ฑ๐ฒ๐ฝ๐ฎ๐ฟ๐๐บ๐ฒ๐ป๐๐, and ๐ฝ๐ผ๐น๐ถ๐ฐ๐-๐บ๐ฎ๐ธ๐ถ๐ป๐ด ๐ฏ๐ผ๐ฑ๐ถ๐ฒ๐ across Southeast Asia, suggesting a clear intent ๐๐ผ ๐ด๐ฎ๐๐ต๐ฒ๐ฟ ๐ถ๐ป๐๐ฒ๐น๐น๐ถ๐ด๐ฒ๐ป๐ฐ๐ฒ ๐๐ถ๐ฒ๐ฑ ๐๐ผ ๐ฟ๐ฒ๐ด๐ถ๐ผ๐ป๐ฎ๐น ๐ด๐ผ๐๐ฒ๐ฟ๐ป๐ฎ๐ป๐ฐ๐ฒ ๐ฎ๐ป๐ฑ ๐ฒ๐ฐ๐ผ๐ป๐ผ๐บ๐ถ๐ฐ ๐๐๐ฟ๐ฎ๐๐ฒ๐ด๐. Exfiltrated data is believed to ๐ช๐ฏ๐ค๐ญ๐ถ๐ฅ๐ฆ ๐ด๐ฆ๐ฏ๐ด๐ช๐ต๐ช๐ท๐ฆ ๐ฎ๐ข๐ต๐ฆ๐ณ๐ช๐ข๐ญ๐ด such as unpublished tariff documents, internal policy briefs, and strategic negotiation content. By leveraging legitimate services like AWS Lambda, Dropbox, and Google Drive for command-and-control and data exfiltration, the attackers successfully ๐ฏ๐๐ฝ๐ฎ๐๐ ๐ฐ๐ผ๐ป๐๐ฒ๐ป๐๐ถ๐ผ๐ป๐ฎ๐น ๐ป๐ฒ๐๐๐ผ๐ฟ๐ธ ๐ฑ๐ฒ๐ณ๐ฒ๐ป๐๐ฒ๐, making detection and attribution more difficult. This operation underscores a broader intelligence-gathering agenda likely linked to state interests, particularly those navigating the geopolitical complexities of U.S.โChina influence, regional trade alignments, and defense modernization efforts.
๐ ๐๐ฒ๐๐ฒ๐ฐ๐๐ถ๐ผ๐ป ๐ฅ๐ฒ๐ฐ๐ผ๐บ๐บ๐ฒ๐ป๐ฑ๐ฎ๐๐ถ๐ผ๐ป๐:
ย ย โข Monitor outbound traffic to AWS Lambda endpoints (*.lambda-url.*.amazonaws.com) for unusual or nonstandard use cases
ย ย โข Deploy behavior-based detection to flag DLL side-loading activity and abnormal service creation
ย ย โข Analyze parent-child process relationships for mscorsvw.exe
โ๏ธ ๐๐ฒ๐ณ๐ฒ๐ป๐๐ถ๐๐ฒ ๐๐ฐ๐๐ถ๐ผ๐ป๐:
ย ย โข Block unauthorized use of cloud storage services (Dropbox, Google Drive) at perimeter
ย ย โข Use cloud traffic inspection tools capable of decrypting and logging cloud API usage
ย ย โข Implement endpoint controls to restrict DLL loading from user-writable directories
๐งฉ ๐๐ผ๐ป๐ฐ๐น๐๐๐ถ๐ผ๐ป
The HazyBeacon malware campaign ๐ฒ๐ ๐ฒ๐บ๐ฝ๐น๐ถ๐ณ๐ถ๐ฒ๐ ๐๐ต๐ฒ ๐๐ผ๐ฝ๐ต๐ถ๐๐๐ถ๐ฐ๐ฎ๐๐ถ๐ผ๐ป ๐ผ๐ณ ๐บ๐ผ๐ฑ๐ฒ๐ฟ๐ป ๐ฐ๐๐ฏ๐ฒ๐ฟ ๐ฒ๐๐ฝ๐ถ๐ผ๐ป๐ฎ๐ด๐ฒโwhere trusted platforms are co-opted to hide state-sponsored operations in plain sight. For defenders, traditional IOCs are no longer enough. The emphasis must shift to context-aware baselining, cloud telemetry visibility, and adaptive controls that detect when familiar tools are used for unfamiliar purposes.
Comments