Threat Actor Profile

CL-STA-1020

No known aliases in database

▲ High Threat

HazyBeacon Cloud-Native Espionage

Origin —

Sponsor State-sponsored organization

Motivation Cyber espionage and intelligence collection, specifically targeting sensitive information regarding regional tariffs and trade disputes.

Target Sectors

Governmental entities in Southeast Asia Government agencies

Abuse of AWS Lambda Function URLs (AuthType: NONE) for C2

DLL side-loading (specifically mscorsvc.dll via mscorsvw.exe)

Deployment of malicious Lambda functions using stolen IAM credentials

Exfiltration via legitimate cloud services (Google Drive, Dropbox)

HazyBeacon Windows backdoor deployment

Persistence through Windows service creation

CISA Advisories ↗

Hacking the mainframe…