The HazyBeacon Protocol – How Malware Weaponizes Amazon Web Services (AWS) Lambda Function URLs

HazyBeacon is a cloud-enabled Windows backdoor campaign that leverages stolen AWS IAM credentials to create public AWS Lambda Function URLs (AuthType:NONE) as stealth C2 relays, making malicious traffic appear as trusted AWS HTTPS traffic; the report outlines the credential-harvest-to-deploy kill chain, malware capabilities (system enumeration, remote task execution, data exfiltration), MITRE ATT&CK mappings, and prioritized mitigations including strong identity hygiene, global CloudTrail logging, Service Control Policies to block public Function URLs, VPC flow telemetry, and cost/invocation anomaly monitoring.