HazyBeacon Abuses AWS Lambda Function URLs for Stealthy Command-and-Control Operations

HazyBeacon is a stealthy cloud-native malware campaign identified as CL-STA-1020. It is exploiting Amazon Web Services (AWS) Lambda Function URLs to create covert command-and-control (C2) channels, marking a significant evolution in attacker tactics.

According to recent Qualys research, the campaign primarily targets government entities across Southeast Asia by exploiting misconfigured serverless infrastructure. This allows adversaries to blend malicious traffic seamlessly with legitimate cloud activity.

HazyBeacon Abuses AWS Lambda Function URLs

Unlike traditional C2 architectures that rely on attacker-owned infrastructure such as VPS servers or compromised domains, HazyBeacon leverages “borrowed infrastructure” by deploying malicious components داخل legitimate AWS environments.

Attackers gain initial access באמצעות stolen Identity and Access Management (IAM) credentials, often harvested from exposed GitHub repositories, phishing campaigns, or compromised developer environments.

These credentials enable threat actors to create Lambda functions and expose them via public Function URLs configured with AuthType set to NONE, effectively bypassing authentication controls.

Once deployed, the Lambda function acts as a proxy, relaying traffic between infected endpoints and the attacker’s backend infrastructure. Malware running on victim systems communicates with the Lambda URL using encrypted HTTP requests, which are then forwarded to the attacker-controlled server.

Responses follow the same path in reverse, forming a resilient, stealthy communication loop. Because all traffic appears to originate from trusted AWS domains ending in “on.aws,” conventional network defenses and domain reputation systems struggle to detect or block the activity.

The malware operates as a lightweight, modular framework designed for flexibility and persistence. Core capabilities include system reconnaissance, remote command execution, payload delivery, and data exfiltration.

By minimizing its footprint on infected systems and offloading communication logic to AWS infrastructure, HazyBeacon reduces its detectability while maintaining operational efficiency.

A key enabler of this campaign is the simplicity and low visibility of AWS Lambda Function URLs. Introduced in 2022, this feature allows developers to expose serverless functions via HTTPS endpoints without requiring API Gateway or load balancers.

While this reduces operational overhead, it also introduces security risks when misconfigured. Publicly accessible endpoints with no authentication provide attackers with an instant, scalable C2 mechanism that leverages AWS’s trusted reputation.

The attack lifecycle follows a predictable cloud-centric kill chain. After a credential compromise, attackers validate permissions by making low-noise API calls, such as get-caller-identity and policy enumeration.

They then deploy Lambda functions in less-monitored regions using benign naming conventions to evade detection. Persistence is achieved by attaching public Function URLs, after which the compromised AWS account becomes an unwitting participant in a global C2 network, processing potentially thousands of malicious requests per hour.

Mapping this activity to the MITRE ATT&CK framework highlights reliance on valid account abuse (T1078.004), serverless execution (T1648), and web service-based C2 (T1102).

Notably, the campaign does not exploit vulnerabilities in AWS itself but instead capitalizes on weak identity governance and insufficient monitoring, reinforcing the growing importance of cloud security hygiene.

Defenders can mitigate such threats by prioritizing identity-centric security controls. Enforcing multi-factor authentication, rotating access keys, and eliminating unused credentials significantly reduce the risk of unauthorized access.

Additionally, enabling comprehensive AWS CloudTrail logging across all regions provides visibility into suspicious API activity, including unauthorized Lambda deployments.

Monitoring infrastructure behavior is equally critical. Lambda functions used as proxies exhibit distinct traffic patterns, often maintaining a near one-to-one ratio between inbound and outbound connections.

Organizations can leverage VPC flow logs and anomaly detection to identify such behavior. Furthermore, implementing Service Control Policies (SCPs) to restrict the creation of public Function URLs unless explicitly approved can effectively enforce a zero-trust model for serverless exposure.

The HazyBeacon campaign underscores a broader shift toward cloud-native attack surfaces, where adversaries weaponize legitimate services to evade detection and complicate attribution.

As cloud adoption accelerates, organizations must recognize that infrastructure misconfigurations and identity weaknesses can transform trusted platforms into active components of cyber espionage operations.

Continuous monitoring, strict access controls, and proactive detection strategies remain essential to preventing cloud environments from becoming attacker-controlled command infrastructure.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.