Cybersecurity researchers have uncovered a sophisticated new hacking campaign, dubbed “OneClik,” that’s been quietly targeting organizations in the energy, oil, and gas industries. What makes this attack particularly tricky? It cleverly abuses everyday tools like Microsoft’s ClickOnce deployment technology and hides its tracks using legitimate cloud services from Amazon Web Services (AWS).
Contents
This campaign uses custom malware and sneaky tactics to fly under the radar, posing a significant threat to critical infrastructure. The key takeaways are its use of trusted tools for malicious purposes, its sophisticated custom backdoor, and its ability to hide command communications within legitimate cloud traffic.
Image representing a cyber attack targeting critical infrastructure like the energy sector
How Attackers Abuse Everyday Tech
At its core, the OneClik campaign is a masterclass in blending in. Instead of relying solely on overtly malicious files that security systems might easily flag, the attackers start by leveraging legitimate tools and services.
The attack often begins with a phishing email. This email leads victims to a fake website, often hosted within the Azure cloud ecosystem, which is designed to look like a legitimate site offering a software tool. However, clicking the link downloads a .APPLICATION file – the kind used by Microsoft’s ClickOnce technology.
ClickOnce is designed to make installing and updating Windows apps super simple, often requiring minimal user interaction. Attackers love this because it can help them get their malicious code onto a system without triggering those familiar “Do you want to allow this app?” warnings (known as User Account Control or UAC prompts). Think of it as using an express lane to bypass security checks.
Researchers found that by using a ClickOnce application, the attackers could trick a trusted system process (dfsvc.exe) into running their malicious code. Since ClickOnce apps normally run with standard user permissions and don’t need elevated administrator rights (like UAC approval), the attackers can get a foothold without raising a major red flag.
The Infection Chain: From ClickOnce to Custom Malware
Once the malicious ClickOnce application is executed, it doesn’t immediately drop the main payload. Instead, it uses a technique called AppDomainManager injection. This is a fancy way of saying it hijacks how a legitimate piece of software (like a standard .NET program) loads its components.
By doing this, the attackers can force a trusted program, such as commonly found executables like ZSATray.exe, umt.exe, or ied.exe, to load and run their own malicious code instead of its normal dependencies. This makes the malicious activity look like it’s coming from a trusted source already running on the computer.
This hidden code is a .NET-based loader, tracked as OneClikNet. Its job is to prepare the system and then deploy the campaign’s main weapon: a sophisticated backdoor written in the Golang programming language, named RunnerBeacon.
Hiding in the Cloud with AWS
After RunnerBeacon is installed, it needs to talk back to the attackers (this is called Command and Control or C2 communication). This is where the second clever trick comes in: using legitimate AWS cloud services.
Instead of connecting to a suspicious, unknown server, the backdoor talks to AWS services like Cloudfront (a content delivery network), API Gateway, or even Lambda functions. For network defenders, traffic to these services often looks like normal cloud activity. It’s like hiding a secret message within billions of everyday conversations happening online.
This “hiding in the cloud” makes it incredibly difficult for security teams to spot the malicious communication without taking drastic measures like decrypting all encrypted traffic or blocking entire AWS domains – actions that would disrupt normal business operations. The attackers exploit the fact that AWS is highly trusted and widely used.
The RunnerBeacon Backdoor: A Deep Dive
The RunnerBeacon backdoor itself is powerful and designed for stealth. It communicates with the attackers using encryption (RC4) and a data format (MessagePack) that helps keep its activities discreet.
It’s built with a modular design, meaning it can perform various tasks based on commands received from the attackers. These capabilities include:
- Running commands on the infected computer.
- Listing running programs.
- Performing file operations (uploading, downloading, deleting).
- Scanning networks.
- Setting up a SOCKS5 tunnel to relay other malicious traffic through the compromised system.
Researchers noted that RunnerBeacon shares some design similarities with other known Go-based backdoors, specifically mentioning connections to the Geacon family, which is often associated with the Cobalt Strike penetration testing tool. This suggests RunnerBeacon might be a custom or evolved version of existing tools, tailored for extra stealth.
Who’s Behind It? Attribution Challenges
While the techniques used in the OneClik campaign are sophisticated and point to a well-resourced group, definitively saying who is responsible is difficult.
However, some clues suggest potential links to state-sponsored threat actors, particularly those affiliated with China. Researchers point to the specific techniques used, such as the .NET AppDomainManager injection and the method for deploying encrypted payloads, which have been observed in past attacks attributed to Chinese groups. Additionally, a preference for using cloud services for staging operations (from providers like Alibaba and Amazon) has been noted in previous China-linked campaigns.
Despite these overlaps, the evidence isn’t conclusive enough for a firm attribution. The complexity of the attack, the use of standard tools, and the cloud-based obfuscation make it hard to leave clear fingerprints.
The discovery of the OneClik campaign, with its clever blend of legitimate tech abuse and sophisticated custom malware, highlights the evolving threat landscape. Defenders in critical sectors like energy need to be aware of how attackers are leveraging trusted tools and services to bypass traditional security measures.
For more details on sophisticated hacking techniques:
- SentinelOne shares new details on China-linked breach attempt
- Microsoft and CrowdStrike partner to link hacking group names
