CL-STA-1020

CL-STA-1020 is a state-backed threat cluster tracked by Palo Alto Networks Unit 42 and associated with the HazyBeacon malware campaign. The campaign targets government networks across Southeast Asia. HazyBeacon is described as a lightweight Windows backdoor that collects host information including hostname, IP address, and user privileges; receives encrypted commands to execute shell instructions or download additional payloads; and exfiltrates stolen documents and captured keystrokes. The activity abuses compromised Amazon Web Services accounts as command-and-control relay infrastructure rather than exploiting AWS vulnerabilities directly. According to the provided content, the operators obtain static IAM access keys from exposed GitHub repositories or phishing, validate them with low-noise AWS API calls, and deploy Lambda Function URLs configured with AuthType: NONE as public HTTPS relays on trusted on.aws domains. Malware traffic is sent via encrypted HTTP POST requests to these Lambda endpoints, which forward payloads to attacker-controlled backend servers and return responses through the same relay path, helping communications blend in as normal encrypted HTTPS traffic to Amazon infrastructure. The content identifies HazyBeacon as the malware/campaign name and CL-STA-1020 as the Unit 42 cluster identifier.