HazyBeacon Campaign Exploits AWS Lambda for Stealthy Cyber Espionage

The HazyBeacon cyber-espionage campaign, tracked as CL-STA-1020, targets Southeast Asian government networks by exploiting AWS Lambda Function URLs to establish covert command-and-control (C2) channels. Researchers from Qualys have identified that attackers are leveraging misconfigured serverless features and stolen cloud credentials, allowing them to blend malicious traffic into trusted AWS infrastructure. This tactic significantly complicates detection efforts. The campaign's stealthy nature and its focus on government entities indicate a serious threat to national security in the region. As of now, there are no specific CVEs or tools disclosed in relation to this campaign, but the implications for affected systems are considerable.

Key Points: • HazyBeacon targets Southeast Asian government networks using AWS Lambda Function URLs. • Attackers exploit misconfigured serverless features and stolen credentials for covert operations. • Detection of HazyBeacon's activities is significantly challenging due to its stealthy tactics.