Cybersecurity researchers have detailed a brand new marketing campaign dubbed OneClik that leverages Microsoft’s ClickOnce software program deployment know-how and bespoke Golang backdoors to compromise organizations throughout the vitality, oil, and gasoline sectors.
“The marketing campaign displays traits aligned with Chinese language-affiliated menace actors, although attribution stays cautious,” Trellix researchers Nico Paulo Yturriaga and Pham Duy Phuc stated in a technical write-up.
“Its strategies mirror a broader shift towards ‘living-off-the-land’ techniques, mixing malicious operations inside cloud and enterprise tooling to evade conventional detection mechanisms.”
The phishing assaults, in a nutshell, make use of a .NET-based loader known as OneClikNet to deploy a complicated Go-based backdoor codenamed RunnerBeacon that is designed to speak with attacker-controlled infrastructure that is obscured utilizing Amazon Net Providers (AWS) cloud providers.
ClickOnce is obtainable by Microsoft as a solution to set up and replace Home windows-based functions with minimal consumer interplay. It was launched in .NET Framework 2.0. Nevertheless, the know-how will be a sexy means for menace actors trying to execute their malicious payloads with out elevating any purple flags.
As famous within the MITRE ATT&CK framework, ClickOnce functions can be utilized to run malicious code by means of a trusted Home windows binary, “dfsvc.exe,” that is chargeable for putting in, launching, and updating the apps. The apps are launched as a baby technique of “dfsvc.exe.”
“As a result of ClickOnce functions obtain solely restricted permissions, they don’t require administrative permissions to put in,” MITRE explains. “As such, adversaries might abuse ClickOnce to proxy execution of malicious code while not having to escalate privileges.”
Trellix stated the assault chains start with phishing emails containing a hyperlink to a faux {hardware} evaluation web site that serves as a conduit for delivering a ClickOnce software, which, in flip, runs an executable utilizing dfsvc.exe.
The binary is a ClickOnce loader that is launched by injecting the malicious code by way of one other approach referred to as AppDomainManager injection, in the end ensuing within the execution of an encrypted shellcode in reminiscence to load the RunnerBeacon backdoor.
The Golang implant can talk with a command-and-control (C2) server over HTTP(s), WebSockets, uncooked TCP, and SMB named pipes, permitting it to carry out file operations, enumerate and terminate working processes, execute shell instructions, escalate privileges utilizing token theft and impersonation, and obtain lateral motion.
Moreover, the backdoor incorporates anti-analysis options to evade detection, and helps community operations like port scanning, port forwarding, and SOCKS5 protocol to facilitate proxy and routing options.
“RunnerBeacon’s design carefully parallels recognized Go-based Cobalt Strike beacons (e.g. the Geacon/Geacon plus/Geacon Professional household),” the researchers stated.
“Like Geacon, the set of instructions (shell, course of enumeration, file I/O, proxying, and so forth.) and use of cross-protocol C2 are very related. These structural and useful similarities recommend RunnerBeacon could also be an advanced fork or a privately modified variant of Geacon, tailor-made for stealthier, and cloud-friendly operations.”
Three completely different variants of OneClick have been noticed in March 2025 alone: v1a, BPI-MDM, and v1d, with every iteration demonstrating progressively improved capabilities to fly below the radar. That stated, a variant of RunnerBeacon was recognized in September 2023 at an organization within the Center East within the oil and gasoline sector.
Though strategies like AppDomainManager injection have been utilized by China– and North Korea-linked menace actors prior to now, the exercise has not been formally attributed to any recognized menace actor or group.
The event comes as QiAnXin detailed a marketing campaign mounted by a menace actor it tracks as APT-Q-14 that has additionally employed ClickOnce apps to propagate malware by exploiting a zero-day cross-site scripting (XSS) flaw within the internet model of an unnamed e-mail platform. The vulnerability, it stated, has since been patched.
The XSS flaw is mechanically triggered when a sufferer opens a phishing e-mail, inflicting the obtain of the ClickOne app. “The physique of the phishing e-mail comes from Yahoo Information, which coincides with the sufferer trade,” QiAnXin famous.
The intrusion sequence serves a mailbox instruction guide as a decoy, whereas a malicious trojan is stealthily put in on the Home windows host to gather and exfiltrate system info to a C2 server and obtain unknown next-stage payloads.
The Chinese language cybersecurity firm stated APT-Q-14 additionally focuses on zero-day vulnerabilities in e-mail software program for the Android platform.
APT-Q-14 has been described by QiAnXin as originating from Northeast Asia and having overlaps with different clusters dubbed APT-Q-12 (aka Pseudo Hunter) and APT-Q-15, that are assessed to be sub-groups inside a South Korea-aligned menace group referred to as DarkHotel (aka APT-C-06).
Earlier this week, Beijing-based 360 Menace Intelligence Heart disclosed DarkHotel’s use of the Convey Your Personal Susceptible Driver (BYOVD) approach to terminate Microsoft Defender Antivirus and deploy malware as a part of a phishing assault that delivered faux MSI set up packages in February 2025.
The malware is engineered to determine communication with a distant server to obtain, decrypt, and execute unspecified shellcode.
“Generally, the [hacking group’s] techniques have tended to be ‘easy’ in recent times: Totally different from the earlier use of heavy-weight vulnerabilities, it has adopted versatile and novel supply strategies and assault strategies,” the corporate stated. “When it comes to assault targets, APT-C-06 nonetheless focuses on North Korean-related merchants, and the variety of targets attacked in the identical interval is larger.”
