Cybersecurity researchers have detailed a brand new marketing campaign dubbed OneClik that leverages Microsoft’s ClickOnce software program deployment know-how and bespoke Golang backdoors to compromise organizations throughout the vitality, oil, and gasoline sectors.
“The marketing campaign reveals traits aligned with Chinese language-affiliated risk actors, although attribution stays cautious,” Trellix researchers Nico Paulo Yturriaga and Pham Duy Phuc stated in a technical write-up.
“Its strategies replicate a broader shift towards ‘living-off-the-land’ ways, mixing malicious operations inside cloud and enterprise tooling to evade conventional detection mechanisms.”
The phishing assaults, in a nutshell, make use of a .NET-based loader referred to as OneClikNet to deploy a classy Go-based backdoor codenamed RunnerBeacon that is designed to speak with attacker-controlled infrastructure that is obscured utilizing Amazon Net Providers (AWS) cloud providers.
ClickOnce is obtainable by Microsoft as a option to set up and replace Home windows-based functions with minimal person interplay. It was launched in .NET Framework 2.0. Nonetheless, the know-how may be a gorgeous means for risk actors seeking to execute their malicious payloads with out elevating any crimson flags.
As famous within the MITRE ATT&CK framework, ClickOnce functions can be utilized to run malicious code via a trusted Home windows binary, “dfsvc.exe,” that is answerable for putting in, launching, and updating the apps. The apps are launched as a baby means of “dfsvc.exe.”
“As a result of ClickOnce functions obtain solely restricted permissions, they don’t require administrative permissions to put in,” MITRE explains. “As such, adversaries might abuse ClickOnce to proxy execution of malicious code while not having to escalate privileges.”
Trellix stated the assault chains start with phishing emails containing a hyperlink to a pretend {hardware} evaluation web site that serves as a conduit for delivering a ClickOnce software, which, in flip, runs an executable utilizing dfsvc.exe.
The binary is a ClickOnce loader that is launched by injecting the malicious code through one other method often known as AppDomainManager injection, in the end ensuing within the execution of an encrypted shellcode in reminiscence to load the RunnerBeacon backdoor.
The Golang implant can talk with a command-and-control (C2) server over HTTP(s), WebSockets, uncooked TCP, and SMB named pipes, permitting it to carry out file operations, enumerate and terminate working processes, execute shell instructions, escalate privileges utilizing token theft and impersonation, and obtain lateral motion.
Moreover, the backdoor incorporates anti-analysis options to evade detection, and helps community operations like port scanning, port forwarding, and SOCKS5 protocol to facilitate proxy and routing options.
“RunnerBeacon’s design carefully parallels recognized Go-based Cobalt Strike beacons (e.g. the Geacon/Geacon plus/Geacon Professional household),” the researchers stated.
“Like Geacon, the set of instructions (shell, course of enumeration, file I/O, proxying, and so on.) and use of cross-protocol C2 are very related. These structural and useful similarities recommend RunnerBeacon could also be an advanced fork or a privately modified variant of Geacon, tailor-made for stealthier, and cloud-friendly operations.”
Three totally different variants of OneClick have been noticed in March 2025 alone: v1a, BPI-MDM, and v1d, with every iteration demonstrating progressively improved capabilities to fly beneath the radar. That stated, a variant of RunnerBeacon was recognized in September 2023 at an organization within the Center East within the oil and gasoline sector.
Though methods like AppDomainManager injection have been utilized by China- and North Korea-linked risk actors up to now, the exercise has not benefited formally attributed to any recognized risk actor or group.
The event comes as QiAnXin detailed a marketing campaign mounted by a risk actor it tracks as APT-Q-14 that has additionally employed ClickOnce apps to propagate malware by exploiting a zero-day cross-site scripting (XSS) flaw within the internet model of an unnamed e-mail platform. The vulnerability, it stated, has since been patched.
The XSS flaw is routinely triggered when a sufferer opens a phishing e-mail, inflicting the obtain of the ClickOne app. “The physique of the phishing e-mail comes from Yahoo Information, which coincides with the sufferer trade,” QiAnXin famous.
The intrusion sequence serves a mailbox instruction handbook as a decoy, whereas a malicious trojan is stealthily put in on the Home windows host to gather and exfiltrate system data to a C2 server and obtain unknown next-stage payloads.
The Chinese language cybersecurity firm stated APT-Q-14 additionally focuses on zero-day vulnerabilities in e-mail software program for the Android platform.
APT-Q-14 has been described by QiAnXin as originating from Northeast Asia and having overlaps with different clusters dubbed APT-Q-12 (aka Pseudo Hunter) and APT-Q-15, that are assessed to be sub-groups inside a South Korea-aligned risk group often known as DarkHotel (aka APT-C-06).
Earlier this week, Beijing-based 360 Risk Intelligence Heart disclosed DarkHotel’s use of the Carry Your Personal Susceptible Driver (BYOVD) method to terminate Microsoft Defender Antivirus and deploy malware as a part of a phishing assault that delivered pretend MSI set up packages in February 2025.
The malware is engineered to determine communication with a distant server to obtain, decrypt, and execute unspecified shellcode.
“Generally, the [hacking group’s] ways have tended to be ‘easy’ lately: Completely different from the earlier use of heavy-weight vulnerabilities, it has adopted versatile and novel supply strategies and assault methods,” the corporate stated. “When it comes to assault targets, APT-C-06 nonetheless focuses on North Korean-related merchants, and the variety of targets attacked in the identical interval is bigger.”
Discovered this text fascinating? Comply with us on Twitter and LinkedIn to learn extra unique content material we publish.
