← Actors

CL-STA-1020

Intel Library

CL-STA-1020

Threat actor0 reports from 0 vendors

CL-STA-1020 targets Southeast Asian government networks, employing AWS Lambda Function URLs configured with AuthType: NONE for stealthy command-and-control communication. The actor has been observed collecting sensitive information from governmental entities, including data on tariffs and trade disputes. An investigation revealed a new Windows backdoor named HazyBeacon, which utilizes this novel C2 technique. This activity cluster has demonstrated significant efforts to remain undetected while executing its operations.

Vendor aliases (1)

The same group is tracked under different names by different vendors.

VendorName
VariousCL-STA-1020

MITRE ATT&CK techniques (0)

No techniques mapped yet.

Indicators of compromise

No IOCs extracted yet from reports naming this actor.

Report timeline

Every report in the Global Intel Library that names CL-STA-1020, newest first. Open any report to see the full analysis with provenance.

    No reports in the Lore library name this actor yet.

    Threat feed IOCs (0)

    Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to CL-STA-1020. Each row shows why it was linked and where it came from.

    No feed indicators linked to this actor yet. Feeds are checked every hour.

    Public research & publications (2)

    Open-source reports about this actor collected from MISP Galaxy.