Hackers Leveraging AWS Lambda URLs Endpoints to Attack Governments Organizations

A previously unreported Windows backdoor dubbed “HazyBeacon” has emerged in a stealthy espionage campaign that began in late 2024 and is still unfolding across several Southeast Asian government networks. The operators exploit the public URL feature of AWS Lambda—originally designed to simplify serverless deployments—to camouflage command-and-control (C2) traffic inside routine cloud operations. The execution flow of Lambda URL abuse shows how every beacon from an infected workstation blends int...