Attackers Abuse AWS Cloud to Target Southeast Asian Governments

Unit 42 observed a targeted campaign (CL-STA-1020) deploying a Windows backdoor named HazyBeacon against government entities in Southeast Asia; the attackers use DLL sideloading and a persistent Windows service to run the backdoor, which communicates with actor-controlled AWS Lambda URLs for C2 and downloads additional payloads, while exfiltrating stolen data through legitimate cloud services like Google Drive and Dropbox. The report highlights the abuse of trusted cloud features to evade detection, provides IoCs, and recommends enhanced monitoring of cloud resource usage and behavioral detection to identify suspicious communications with trusted services.