Trellix details OneClik malware campaign targeting energy, oil and gas sectors using ClickOnce, cloud evasion

Trellix's 'OneClik' malware campaign is actively targeting the energy, oil, and gas sectors, leveraging sophisticated phishing and abusing Microsoft ClickOnce for stealthy payload delivery. This advanced persistent threat employs .NET AppDomainManager hijacking and a Golang backdoor, notably utilizing legitimate AWS cloud services for command-and-control, which severely complicates detection for traditional security measures. The campaign's 'living off the land' approach and tactical overlaps with Chinese APTs underscore a critical shift in cyber warfare, necessitating enhanced behavioral analysis and adaptive defensive strategies for organizations.

Analysis

A sophisticated advanced persistent threat (APT) campaign, dubbed 'OneClik', is actively targeting the global energy, oil, and gas sectors with a long-term, persistent effort, as evidenced by variants identified in the Middle East as far back as September 2023. The campaign leverages a 'living off the land' strategy, abusing trusted enterprise technologies to evade detection, specifically Microsoft's .NET ClickOnce deployment technology for initial payload delivery and Amazon's AWS services (CloudFront, API Gateway, Lambda) for command-and-control (C2) communications. This methodology makes the threat exceptionally difficult to detect with conventional signature-based or network-level security tools. The attackers employ advanced evasion techniques that have evolved across several variants, including .NET AppDomainManager hijacking for early-stage code injection, in-memory decryption, and sophisticated anti-analysis measures such as disabling ETW, anti-debugging checks, and sandbox fingerprinting (e.g., checking for >8GB RAM and domain-joined status). While Trellix notes a low-confidence link to Chinese-affiliated actors like APT41 based on overlapping tactics, techniques, and procedures (TTPs), the key takeaway is the systemic risk posed by the abuse of ubiquitous cloud and software platforms, a trend also seen in other campaigns utilizing Alibaba Cloud.

Key Decisions for Investors

• Investors with exposure to the energy, oil, and gas sectors should heighten scrutiny of portfolio companies' cybersecurity defenses, specifically inquiring about their capabilities in behavioral threat detection and response to counter 'living off the land' attacks.
• The ineffectiveness of traditional security against this campaign presents a tailwind for cybersecurity firms specializing in advanced Endpoint Detection and Response (EDR), Zero Trust architecture, and cloud security posture management (CSPM), as enterprises are forced to upgrade their defenses.
• For investors in large-cap technology platforms like Microsoft and Amazon, this event highlights a persistent operational and reputational risk rather than an immediate fundamental threat; the neutral sentiment score reflects that their services are being abused, not that they are at fault.
• The campaign's focus on critical infrastructure and its potential link to state-affiliated actors introduces a geopolitical risk factor that could lead to heightened volatility in energy markets and defense-related stocks.