Novel Covert C2 HazyBeacon Backdoor Activity

Kaung Khant Ko@kaungkhantko

•updated Jul 16, 2025•2•6•52

Detects TTPs associated with the HazyBeacon backdoor, used by the threat cluster CL-STA-1020. This rule identifies the creation of a specific persistence service and the execution of custom exfiltration tools from the C:\ProgramData directory. This threat also uses C2 communication via AWS Lambda URLs (e.g., *.lambda-url.*.on.aws) from the mscorsvw.exe process, which should be monitored via network logs.