HazyBeacon Camapign Weaponizes Amazon Web Services for Stealthy Communications

Cybersecuritynews •Tushar Subhra Dutta • June 3, 2026

A new malware campaign is turning trusted cloud infrastructure against the organizations that rely on it. Known as HazyBeacon and tracked under cluster identifier CL-STA-1020, the campaign targets government networks across Southeast Asia. Rather than using easily blocked servers, the threat actors hide inside one of the world’s most trusted platforms, Amazon Web Services (AWS). […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

HazyBeacon Campaign Exploits AWS for Stealthy Cyber Espionage in Southeast Asia The HazyBeacon campaign, tracked as CL-STA-1020, is a newly identified cyber espionage operation exploiting Amazon Web Services (AWS) for command-and-control communications. The campaign primarily targets government networks in Southeast Asia, utilizing AWS's trusted infrastructure to evade detection. Threat actors are leveraging misconfigurations within AWS to establish stealthy C2 channels, complicating defense efforts. This represents a significant shift towards cloud-native attack strategies, indicating a growing trend in cyber threats. The specific tools and techniques used in this campaign have not been disclosed, but the reliance on AWS highlights vulnerabilities in cloud services. As of now, the campaign is ongoing, with no reports of mitigation or remediation efforts detailed in the articles. 2 sources 73

Extracted Entities

HazyBeacon Camapign Weaponizes Amazon Web Services for Stealthy Communications

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Companies (1)

Industries (1)