Cybersecurity researchers have detailed a brand new marketing campaign dubbed OneClik that leverages Microsoft’s ClickOnce software program deployment expertise and bespoke Golang backdoors to compromise organizations throughout the power, oil, and fuel sectors.
“The marketing campaign displays traits aligned with Chinese language-affiliated menace actors, although attribution stays cautious,” Trellix researchers Nico Paulo Yturriaga and Pham Duy Phuc mentioned in a technical write-up.
“Its strategies mirror a broader shift towards ‘living-off-the-land’ ways, mixing malicious operations inside cloud and enterprise tooling to evade conventional detection mechanisms.”
The phishing assaults, in a nutshell, make use of a .NET-based loader referred to as OneClikNet to deploy a classy Go-based backdoor codenamed RunnerBeacon that is designed to speak with attacker-controlled infrastructure that is obscured utilizing Amazon Net Companies (AWS) cloud providers.
ClickOnce is obtainable by Microsoft as a solution to set up and replace Home windows-based functions with minimal person interplay. It was launched in .NET Framework 2.0. Nevertheless, the expertise could be a lovely means for menace actors trying to execute their malicious payloads with out elevating any crimson flags.
As famous within the MITRE ATT&CK framework, ClickOnce functions can be utilized to run malicious code by a trusted Home windows binary, “dfsvc.exe,” that is accountable for putting in, launching, and updating the apps. The apps are launched as a baby means of “dfsvc.exe.”
“As a result of ClickOnce functions obtain solely restricted permissions, they don’t require administrative permissions to put in,” MITRE explains. “As such, adversaries might abuse ClickOnce to proxy execution of malicious code while not having to escalate privileges.”
Trellix mentioned the assault chains start with phishing emails containing a hyperlink to a pretend {hardware} evaluation web site that serves as a conduit for delivering a ClickOnce software, which, in flip, runs an executable utilizing dfsvc.exe.
The binary is a ClickOnce loader that is launched by injecting the malicious code by way of one other method often known as AppDomainManager injection, in the end ensuing within the execution of an encrypted shellcode in reminiscence to load the RunnerBeacon backdoor.
The Golang implant can talk with a command-and-control (C2) server over HTTP(s), WebSockets, uncooked TCP, and SMB named pipes, permitting it to carry out file operations, enumerate and terminate operating processes, execute shell instructions, escalate privileges utilizing token theft and impersonation, and obtain lateral motion.
Moreover, the backdoor incorporates anti-analysis options to evade detection, and helps community operations like port scanning, port forwarding, and SOCKS5 protocol to facilitate proxy and routing options.
“RunnerBeacon’s design carefully parallels identified Go-based Cobalt Strike beacons (e.g. the Geacon/Geacon plus/Geacon Professional household),” the researchers mentioned.
“Like Geacon, the set of instructions (shell, course of enumeration, file I/O, proxying, and so on.) and use of cross-protocol C2 are very related. These structural and practical similarities recommend RunnerBeacon could also be an developed fork or a privately modified variant of Geacon, tailor-made for stealthier, and cloud-friendly operations.”
Three totally different variants of OneClick have been noticed in March 2025 alone: v1a, BPI-MDM, and v1d, with every iteration demonstrating progressively improved capabilities to fly below the radar. That mentioned, a variant of RunnerBeacon was recognized in September 2023 at an organization within the Center East within the oil and fuel sector.
Though methods like AppDomainManager injection have been utilized by China– and North Korea-linked menace actors prior to now, the exercise has not been formally attributed to any identified menace actor or group. Trellix instructed The Hacker Information that it didn’t have any extra particulars to share on the size of those assaults and the areas which have been focused.
The event comes as QiAnXin detailed a marketing campaign mounted by a menace actor it tracks as APT-Q-14 that has additionally employed ClickOnce apps to propagate malware by exploiting a zero-day cross-site scripting (XSS) flaw within the net model of an unnamed electronic mail platform. The vulnerability, it mentioned, has since been patched.
The XSS flaw is routinely triggered when a sufferer opens a phishing electronic mail, inflicting the obtain of the ClickOne app. “The physique of the phishing electronic mail comes from Yahoo Information, which coincides with the sufferer trade,” QiAnXin famous.
The intrusion sequence serves a mailbox instruction guide as a decoy, whereas a malicious trojan is stealthily put in on the Home windows host to gather and exfiltrate system data to a C2 server and obtain unknown next-stage payloads.
The Chinese language cybersecurity firm mentioned APT-Q-14 additionally focuses on zero-day vulnerabilities in electronic mail software program for the Android platform.
APT-Q-14 has been described by QiAnXin as originating from Northeast Asia and having overlaps with different clusters dubbed APT-Q-12 (aka Pseudo Hunter) and APT-Q-15, that are assessed to be sub-groups inside a South Korea-aligned menace group often known as DarkHotel (aka APT-C-06).
Earlier this week, Beijing-based 360 Risk Intelligence Heart disclosed DarkHotel’s use of the Convey Your Personal Susceptible Driver (BYOVD) method to terminate Microsoft Defender Antivirus and deploy malware as a part of a phishing assault that delivered pretend MSI set up packages in February 2025.
The malware is engineered to ascertain communication with a distant server to obtain, decrypt, and execute unspecified shellcode.
“Normally, the [hacking group’s] ways have tended to be ‘easy’ in recent times: Totally different from the earlier use of heavy-weight vulnerabilities, it has adopted versatile and novel supply strategies and assault methods,” the corporate mentioned. “When it comes to assault targets, APT-C-06 nonetheless focuses on North Korean-related merchants, and the variety of targets attacked in the identical interval is bigger.”
