APT Group Abuses AWS with HazyBeacon Malware in Southeast Asian Government Attacks
In early 2024, an advanced persistent threat (APT) group leveraged Amazon Web Services (AWS) infrastructure to conduct an intelligence-gathering campaign targeting government entities in Southeast Asia. The attackers deployed the novel "HazyBeacon" backdoor, which communicated with command-and-control (C2) infrastructure over legitimate cloud channels to evade detection, facilitating both surveillance and data exfiltration. By abusing trusted AWS services, the group masked malicious traffic as normal cloud activity, making identification and remediation complex and exposing sensitive government operations to compromise. This incident underscores a rapidly growing trend where threat actors exploit cloud provider services as covert C2 and exfiltration channels. With attackers blending into legitimate cloud workflows, organizations face heightened urgency to enhance cloud-native visibility, enforce east-west traffic controls, and implement zero trust segmentation to mitigate advanced threats.
Kill Chain
