Hackers abuse Microsoft ClickOnce and AWS services for stealthy attacks

A sophisticated cyber campaign, dubbed OneClik, is actively targeting the energy, oil, and gas sectors by exploiting Microsoft's ClickOnce deployment tool and custom Golang backdoors like RunnerBeacon. This evolving threat leverages legitimate AWS cloud services for command-and-control, making detection challenging as malicious traffic blends with normal cloud usage and bypasses traditional security controls. While operational indicators suggest China-affiliated threat actors, attribution remains cautious. The campaign's advanced tactics, including bypassing user account controls and using AppDomainManager injection, highlight a significant and persistent risk to critical infrastructure, potentially necessitating enhanced cybersecurity investments and vigilance within these industries.

Analysis

A sophisticated cyber campaign, named OneClik, is actively targeting organizations in the energy, oil, and gas sectors, representing a significant threat to critical infrastructure. The attack leverages legitimate enterprise tools, specifically exploiting Microsoft's (MSFT) ClickOnce deployment technology to deliver malware payloads without triggering user account controls, thereby proxying execution through trusted processes. A key element of its stealth is the use of Amazon's (AMZN) legitimate cloud services, including AWS, Cloudfront, and Lambda, for its command and control (C2) infrastructure. This tactic makes malicious traffic exceptionally difficult to distinguish from benign cloud activity, a significant challenge for network defenders. The campaign deploys a custom Golang backdoor, "RunnerBeacon," which researchers at Trellix note is an evolved and stealthier variant of known tools used by threat actors. While attribution remains cautious, the tactics, techniques, and procedures—such as the use of AppDomainManager injection and cloud-based staging previously seen with Alibaba (BABA) and Amazon services—align with those of China-affiliated state actors. The campaign's evolution and use of robust anti-analysis techniques indicate a persistent and advanced adversary focused on long-term espionage or disruption within strategically important industries.

Key Decisions for Investors

• Investors with holdings in the energy, oil, and gas sectors should re-evaluate the cybersecurity risk exposure of their portfolio companies, as this targeted campaign could lead to operational disruptions or increased security-related capital expenditures.
• The abuse of Microsoft's and Amazon's platforms highlights a persistent platform integrity risk; monitor both MSFT and AMZN for disclosures on mitigation efforts, as continued exploitation could impact enterprise customer trust and sentiment.
• This event reinforces the investment thesis for the cybersecurity sector, particularly for firms specializing in advanced endpoint detection, cloud security posture management (CSPM), and threat intelligence, which are essential for defending against such sophisticated attacks.
• The suspected link to a state-affiliated actor elevates the geopolitical risk premium for investments in critical infrastructure, warranting closer attention to nation-state cyber activity as a potential market-moving factor.