Cybersecurity researchers have uncovered a sophisticated attack campaign called OneClik that specifically targets organizations in the energy, oil, and gas sectors. The campaign exploits Microsoft’s ClickOnce technology combined with custom-built backdoors to infiltrate corporate networks.
## Campaign Overview
Security firm Trellix identified the OneClik campaign, which shows characteristics consistent with Chinese-affiliated threat actors, though researchers remain cautious about definitive attribution. The attack represents a growing trend toward “living-off-the-land” tactics, where cybercriminals blend malicious operations within legitimate cloud and enterprise tools to avoid detection.
## How the Attack Works
The campaign operates through a multi-stage process:
**Initial Infection**: Attackers send phishing emails containing links to fake hardware analysis websites. These sites deliver a ClickOnce application that appears legitimate to users.
**Payload Deployment**: The ClickOnce app uses a .NET-based loader called OneClikNet to deploy RunnerBeacon, a sophisticated backdoor written in the Go programming language.
**Command and Control**: The malware communicates with attacker-controlled servers hidden behind Amazon Web Services (AWS) cloud infrastructure.
## Why ClickOnce is Attractive to Attackers
Microsoft’s ClickOnce technology was designed to simplify software installation and updates for Windows applications. However, it has become an attractive tool for cybercriminals because:
– Applications don’t require administrative permissions to install
– The technology uses trusted Windows processes, making detection difficult
– Malicious code can run through legitimate system binaries without raising security alerts
## RunnerBeacon Capabilities
The Go-based backdoor deployed in these attacks offers extensive functionality:
– **Communication**: Supports multiple protocols including HTTP(s), WebSockets, TCP, and SMB
– **System Control**: Can execute shell commands, manage files, and terminate processes
– **Privilege Escalation**: Uses token theft and impersonation techniques
– **Network Operations**: Includes port scanning, forwarding, and proxy capabilities
– **Evasion**: Incorporates anti-analysis features to avoid security detection
Researchers note that RunnerBeacon closely resembles known Cobalt Strike beacons, particularly the Geacon family, suggesting it may be an evolved variant designed for cloud-friendly operations.
## Campaign Evolution
Three variants of OneClik were observed in March 2025 alone, with each version showing improved stealth capabilities. However, researchers traced the earliest RunnerBeacon variant back to September 2023 at a Middle Eastern oil and gas company.
## Related Threats
The OneClik campaign is part of a broader pattern of ClickOnce abuse. Chinese security firm QiAnXin reported similar tactics used by APT-Q-14, another threat group that exploited zero-day vulnerabilities in email platforms to distribute ClickOnce applications.
Additionally, the DarkHotel group (APT-C-06) has been observed using advanced techniques including the Bring Your Own Vulnerable Driver (BYOVD) method to disable Microsoft Defender and install malware through fake software packages.
## Industry Impact
These campaigns highlight the evolving threat landscape facing critical infrastructure sectors. Energy companies are increasingly targeted due to their strategic importance and valuable data. The sophisticated nature of these attacks, combined with their use of legitimate cloud services and enterprise tools, makes detection and prevention particularly challenging for traditional security systems.
The OneClik campaign demonstrates how threat actors continue to adapt their methods, leveraging trusted technologies and cloud infrastructure to conduct stealthy, long-term operations against high-value targets.