Government Organizations Targeted via AWS Lambda URL Endpoint Exploits

Unit 42 researchers from Palo Alto Networks have been monitoring a sophisticated threat cluster designated CL-STA-1020, which has been systematically targeting governmental entities across Southeast Asia.

This operation focuses on extracting sensitive data from government agencies, particularly details surrounding recent tariffs and trade disputes, underscoring a motive rooted in espionage and intelligence gathering.

The campaign stands out for its innovative use of a previously undocumented Windows backdoor, dubbed HazyBeacon, which exploits AWS Lambda URLs to establish a stealthy command-and-control (C2) infrastructure.

Novel Backdoor Emerges

By leveraging legitimate AWS serverless functions invoked via HTTPS endpoints, the threat actors create a scalable, resilient communication channel that blends seamlessly with benign cloud traffic, evading traditional network defenses.

This technique, first highlighted by Trellix in June 2025 in relation to advanced persistent threat (APT) activities, allows malicious operations to masquerade as routine AWS interactions, complicating detection in environments with heavy cloud dependencies.

The attack chain begins with DLL sideloading, where adversaries deploy the malicious mscorsvc.dll in the C:\Windows\assembly directory alongside the legitimate Microsoft executable mscorsvw.exe.

Upon execution via its associated Windows service, the sideloaded DLL initiates beaconing to an attacker-controlled AWS Lambda URL, such as those resolving to lambda-url.ap-southeast-1.on.aws subdomains.

Persistence is achieved through the creation of a custom Windows service named msdnetsvc, ensuring the backdoor reactivates post-reboot.

Once connected, HazyBeacon downloads additional payloads to C:\ProgramData, including legitimate tools like 7z.exe for file archiving and custom utilities for data collection and exfiltration.

For instance, the igfx.exe payload serves as a file collector, scanning for specified extensions within defined time ranges and compressing results into ZIP archives named after the compromised machine.

These archives are then split into 200 MB chunks using 7z.exe, facilitating targeted reconnaissance for documents related to trade disputes, such as searches for “letter to US President on Tariffs measures.”

Exfiltration Tactics

Exfiltration efforts further demonstrate the actors’ emphasis on blending with legitimate traffic, employing custom tools like GoogleGet.exe for authenticating to Google Drive repositories via provided drive IDs, followed by uploaders such as google.exe, GoogleDrive.exe, and GoogleDriveUpload.exe for transferring collected data.

Similarly, Dropbox.exe handles uploads to Dropbox, routing exfiltrated files through trusted cloud storage services to mimic normal enterprise activity.

According to the Report, Although these attempts were detected and blocked in monitored environments, the operation concludes with cleanup commands that erase payloads, archives, and traces, minimizing forensic footprints.

This abuse of AWS Lambda, introduced in 2022 for direct HTTPS function invocation without API Gateway overhead, provides tactical advantages including dynamic C2 without persistent servers, exploiting the ubiquity of amazonaws.com domains in legitimate traffic.

The campaign exemplifies how adversaries repurpose cloud-native features for malice, prompting security teams to enhance monitoring of anomalous cloud communications and adopt behavioral analytics for detecting deviations in serverless interactions.

Indicators of Compromise

File Path	Description	SHA256 Hash
C:\Windows\assembly\mscorsvc.dll	Lambda-URL backdoor	4931df8650521cfd686782919bda0f376475f9fc5f1fee9d7cf3a4e0d9c73e30
C:\ProgramData\google.exe	Google Drive file uploader	d20b536c88ecd326f79d7a9180f41a2e47a40fcf2cc6a2b02d68a081c89eaeaa
C:\ProgramData\GoogleDrive.exe	Google Drive file uploader	304c615f4a8c2c2b36478b693db767d41be998032252c8159cc22c18a65ab498
C:\ProgramData\GoogleDriveUpload.exe	Google Drive file uploader	f0c9481513156b0cdd216d6dfb53772839438a2215d9c5b895445f418b64b886
C:\ProgramData\Dropbox.exe	Dropbox file uploader	3255798db8936b5b3ae9fed6292413ce20da48131b27394c844ecec186a1e92f
C:\ProgramData\igfx.exe	File collector	279e60e77207444c7ec7421e811048267971b0db42f4b4d3e975c7d0af7f511e
C:\ProgramData\GoogleGet.exe	Google Drive connect tool	d961aca6c2899cc1495c0e64a29b85aa226f40cf9d42dadc291c4f601d6e27c3

Stay Updated on Daily Cybersecurity News. Follow us on Google News, LinkedIn, and X.