Hackers abuse Microsoft ClickOnce and AWS services for stealthy attacks
Researchers refer to this sophisticated malicious campaign as OneClik, which has been using proprietary Golang backdoors and Microsoft's ClickOnce software deployment tool to infect companies in the oil, gas, and energy industries.
The hackers conceal the command and control (C2) infrastructure by using authentic AWS cloud services (AWS, Cloudfront, API Gateway, and Lambda).
Microsoft's ClickOnce deployment technique minimises user intervention by enabling developers to construct Windows-based programmes that update themselves.
Three versions of the campaign (v1a, BPI-MDM, and v1d) were examined by security experts at cybersecurity firm Trellix. They all used a.NET-based loader disguised as OneClikNet to install "a sophisticated Golanguage backdoor" known as RunnerBeacon read mor...