Varonis Demonstrates NotC2 AI-Powered C2 Framework Built on AWS
Summary
Varonis Threat Labs presents NotC2, a proof-of-concept using SQS, Lambda, SNS and Amazon Bedrock for post-compromise AWS command and control, detailing its permissions, cloud-log detection signals and defensive controls.
Key points
- NotC2 is a proof-of-concept that assumes an attacker already has AWS credentials and uses native AWS services for command delivery, execution and results.
- SQS delivers commands to a Lambda function, which performs operations using its execution role; SNS sends results to an external endpoint.
- Amazon Bedrock translates natural-language prompts into AWS API operations and can help chain reconnaissance tasks, without exceeding the identity's permissions.
- Deployment requires permissions to create or configure the infrastructure and attach an execution role; runtime activity also depends on the role's access to Bedrock and target resources.
- The framework reduces conventional network indicators, but related activity may appear across CloudTrail, Lambda, SNS and Bedrock logs; message content requires additional logging to inspect.
- The article recommends least-privilege IAM, restricting external SNS subscriptions and correlating activity across the queue, function, model and topic.
Article Details
- Attack Vectors
- Use compromised AWS credentials to create or reuse SQS, Lambda, and SNS resources for a cloud-native command-and-control loop.
- Deliver commands through an SQS queue, trigger a Lambda function to execute AWS API operations, and use Amazon Bedrock to translate natural-language requests into those operations.
- Publish command results through SNS to an attacker-controlled external HTTP or HTTPS endpoint.
- Use the Lambda execution role's permissions to enumerate AWS resources, including EC2 instances, DynamoDB tables, databases, and Lambda functions.
- The article describes privilege escalation or discovery of more privileged credentials as possible prerequisites when compromised credentials lack permissions to deploy the infrastructure.
- Defensive Notes
- Enforce IAM least privilege for identities and Lambda execution roles; restrict queue and function creation, event-source mapping configuration, role passing, Bedrock invocation, and access to unrelated AWS resources.
- Restrict creation and modification of external SNS HTTP/HTTPS subscriptions, allow only approved destinations, and limit functions to publishing through intended topics.
- Limit unrestricted internet egress from Lambda functions where it is not required; this reduces some delivery and exfiltration paths but does not by itself block SNS-based result delivery.
- Enable and correlate CloudTrail management and data events, Lambda execution logs, SNS delivery-status logs, and Bedrock model invocation logs. CloudTrail management events are recorded by default, while data events require explicit configuration.
- Investigate external SNS subscriptions created by Lambda execution roles, unusual Bedrock Converse or InvokeModel activity, and sequences linking unexpected SQS messages, Lambda execution, Bedrock calls, AWS API activity, and SNS publishing.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelNotC2 publishes command output through SNS to an external attacker endpoint.T1059.009 · Cloud APINotC2 uses Amazon Bedrock to translate natural-language requests into AWS API operations executed by the Lambda function.T1078.004 · Cloud AccountsNotC2 assumes the operator has compromised AWS credentials to access the victim's account.T1102.002 · Bidirectional CommunicationNotC2 uses AWS messaging services, including SQS for command delivery and SNS for returning results, as its C2 channel.T1526 · Cloud Service DiscoveryThe article demonstrates NotC2 using AWS API operations to discover resources such as DynamoDB tables and Lambda functions.T1580 · Cloud Infrastructure DiscoveryThe article demonstrates NotC2 enumerating EC2 instances and describes requests to list accessible AWS resources.T1648 · Serverless ExecutionNotC2 uses an SQS-triggered Lambda function to execute commands within the victim's AWS account.
People
Vendors
Products
Amazon BedrockVaronis Threat Labs built NotC2, a proof-of-concept C2 framework that uses native AWS and Amazon Bedrock to process natural-language commands.Amazon S3Cloud storage extends the same idea. Commands and exfiltrated data can flow through Amazon S3, Google Drive, OneDrive, and Azure Blob Storage. These services are so fundamental to business operations that blocking themAmazon SNS3. Amazon SNS (Simple Notification Service) - a fully managed pub/sub messaging service for fan-out notifications and workflow triggers. In NotC2, it is the results channel: the function publishes command output to aAmazon SQS1. Amazon SQS (Simple Queue Service) - a fully managed message queuing service that organizations use to decouple microservices, process background jobs, and buffer high-traffic workloads. In NotC2, it is the commandAWS LambdaFigure 3: AWS CLI command used to create the NotC2 SQS queue2. AWS Lambda - a serverless compute service that runs code in response to events, with no servers to provision or manage. In NotC2, it is the executionCloudTrailThe activity, however, carries on inside the victim's own cloud logs. The signal is scattered across CloudTrail management and data events, Lambda execution logs, SNS delivery-status logs, and Bedrock model invocation
Tools
NotC2NotC2: How We Built an AI-Powered C2 Channel With AWS ServicesPacubest path is reusing existing roles wherever their permissions allow it, and enumeration tools like Pacu are built to find exactly that path, though enumeration itself needs permissions, typically List actions.XRayC2AWS services can be abused in much the same way. XRayC2, built by Dhiraj Mishra, embeds commands in X-Ray trace annotations, while compromised hosts poll for tasks through the same monitoring API the application already