Since late 2024, Unit 42 researchers have been tracking a cluster of suspicious activity as CL-STA-1020, targeting governmental entities in Southeast Asia. The threat actors behind this cluster of activity have been collecting sensitive information from government agencies, including information about recent tariffs and trade disputes.
This campaign is particularly noteworthy due to its novel tradecraft. The threat actors have developed a previously undocumented Windows backdoor, which we named HazyBeacon. This backdoor leverages AWS Lambda URLs as command and control (C2) infrastructure. AWS Lambda URLs are a feature of AWS Lambda that allows users to invoke serverless functions directly over HTTPS.
Read more…
Source: Palo Alto Unit 42
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Microsoft’s Azure Linux gets 470-plus security fixes in one almighty patching session
November 9, 2026
Microsoft has unleashed a whopper of an update for Azure Linux, packing more than 470 CVE fixes into a single release as the software industry’s ever-growing pile of vulnerabilities shows little sign of shrinking. Over the weekend, Microsoft rolled out Azure Linux 3.0.2022 with fixes covering everything from the Linux kernel to open source packages and ...
- 13.3 million people’s medical data exposed; companies pay $300,000
November 9, 2026
The New York attorney general (AG) has reached a settlement over a medical data breach that affected 13.3 million people after basic security failures. Perry Johnson & Associates (PJ&A) and four related companies have agreed to pay $300,000 and implement extensive security reforms following a breach that exposed personal and medical information belonging to more than ...
- Nvidia stock falls 5% as scrutiny turns to Jensen Huang’s affair with alleged Chinese spy
November 9, 2026
Nvidia stock fell 5% on Monday after the tech giant launched an investigation into CEO Jensen Huang’s relationship with a businesswoman who intelligence agencies say is a Chinese spy. U.S. intelligence agencies said Alice Huang, an executive at cloud company MegaSpeed, has been passing information to Beijing, according to reports in The New York Times and ...
- Iris Ohyama attack exposes info of 7.7 million customers
November 9, 2026
Major Japanese consumer goods manufacturer Iris Ohyama has confirmed suffering a cyberattack which saw it lose data on 7.7 million people. The company first disclosed the breach on October 29, 2026 when it confirmed “unauthorized access on the e-commerce site” Iris Plaza. At the time, the company said its investigation was ongoing, and that it would ...
- Hundreds of Artex AI hacking tools found publicly exposed to the web
November 6, 2026
Security researchers have discovered hundreds of copies of a Chinese-made AI hacking tool publicly exposed to the internet for anyone to access, potentially allowing outsiders to launch cyberattacks against unsuspecting targets. The hacking software, called Artex, is an open source autonomous penetration testing tool, meaning software that automatically probes computer systems for weaknesses, and it’s been ...
- FBI agent steals $2.47 million in crypto tied to 35 investigations and plans Portugal escape
November 6, 2026
A former FBI agent stole $2.47 million in crypto using classified investigative records, compromising federal investigations into criminal organizations and foreign adversaries. The US Department of Justice disclosed on Nov. 5 that Patrick Steven Yaroch, 37, pleaded guilty to wire fraud and money laundering after exploiting his access to crypto wallet credentials collected during FBI investigations. His ...