HazyBeacon Campaign Abuses AWS for Stealthy C2 Communications

Gbhackers •Mayura Kathir • June 3, 2026

A newly documented cyber espionage operation known as HazyBeacon, tracked as CL-STA-1020, is leveraging Amazon Web Services (AWS) to build stealthy command-and-control (C2) channels that are difficult for defenders to detect. The campaign primarily targets government networks in Southeast Asia and represents a growing shift toward cloud-native attack infrastructure. This misconfiguration enables threat actors to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

HazyBeacon Campaign Exploits AWS for Stealthy Cyber Espionage in Southeast Asia The HazyBeacon campaign, tracked as CL-STA-1020, is a newly identified cyber espionage operation exploiting Amazon Web Services (AWS) for command-and-control communications. The campaign primarily targets government networks in Southeast Asia, utilizing AWS's trusted infrastructure to evade detection. Threat actors are leveraging misconfigurations within AWS to establish stealthy C2 channels, complicating defense efforts. This represents a significant shift towards cloud-native attack strategies, indicating a growing trend in cyber threats. The specific tools and techniques used in this campaign have not been disclosed, but the reliance on AWS highlights vulnerabilities in cloud services. As of now, the campaign is ongoing, with no reports of mitigation or remediation efforts detailed in the articles. 2 sources 73

Extracted Entities

HazyBeacon Campaign Abuses AWS for Stealthy C2 Communications

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Industries (1)

MITRE ATT&CK (1)