Varonis Threat Labs builds NotC2, a proof-of-concept AWS-native C2 using SQS, Lambda, SNS and Amazon Bedrock
Varonis Threat Labs published on 6 November 2026 a proof-of-concept post-compromise command-and-control framework named NotC2, which chains native AWS services inside an already-compromised account instead of relying on external attacker infrastructure. Commands arrive in an Amazon SQS queue, an event source mapping triggers an AWS Lambda function that executes them with its execution role, Amazon Bedrock translates natural-language instructions into AWS API calls, and Amazon SNS publishes results to an attacker-controlled HTTPS endpoint. Varonis describes the loop as running inside the victim's own account, with SQS as the command channel, Lambda as the execution engine, SNS as the results channel and Bedrock as the AI command interpreter (varonis.com via fourweekmba.com). This is service abuse, not a vulnerability in Bedrock or AWS, and it requires stolen credentials with permissions to create the infrastructure and pass a role to Lambda, so IAM authorization still bounds what the operator can reach. Operational urgency is therefore limited: no patch exists or is needed, and no in-the-wild use is reported.
Detalhes técnicos
The asynchronous design removes the persistent attacker connection typical of conventional C2; each Lambda invocation lasts at most 15 minutes and leaves no continuously running implant, though the deployed cloud resources and their API activity remain investigative evidence. A generic tool specification, execute_aws_operation, accepts a service, an operation and parameters, letting the orchestration layer issue supported AWS requests; API responses and errors feed back into the model, enabling revised and chained operations. Researchers demonstrated enumeration of EC2 instances, DynamoDB tables, databases and Lambda functions, lowering the expertise required for reconnaissance without bypassing IAM or granting new permissions. External delivery is performed by SNS after the attacker confirms the subscription, so Lambda egress restrictions alone do not cut the channel. The work extends earlier trusted-service C2 research, including Rhino Security Labs' demonstration of Cobalt Strike traffic through S3 objects. Varonis notes that CloudTrail redacts SQS and SNS message content, so observing the services in use is not the same as seeing the commands (varonis.com via fourweekmba.com).
Remediação
Network blocking is insufficient because the traffic is authenticated HTTPS to legitimate AWS endpoints. Varonis recommends strict IAM least privilege and monitoring across CloudTrail, Lambda logs, SNS delivery records and Bedrock invocation logs, noting that management events expose configuration changes while relevant data events require explicit enablement. Detection should correlate infrastructure creation, queue-to-function event source mappings, role assignment (iam:PassRole), unexpected Bedrock invocation by a Lambda role and external SNS subscriptions. Varonis highlights signals such as a Lambda role adding an external SNS subscriber and unusual Bedrock calls by a Lambda role (varonis.com via fourweekmba.com).
Linha do tempo
-
Varonis Threat Labs builds NotC2, a proof-of-concept AWS-native C2 using SQS, Lambda, SNS and Amazon Bedrock
ler a análise desta fonte ocultar
Varonis Threat Labs published on 6 November 2026 a proof-of-concept post-compromise command-and-control framework named NotC2, which chains native AWS services inside an already-compromised account instead of relying on external attacker infrastructure. Commands arrive in an Amazon SQS queue, an event source mapping triggers an AWS Lambda function that executes them with its execution role, Amazon Bedrock translates natural-language instructions into AWS API calls, and Amazon SNS publishes results to an attacker-controlled HTTPS endpoint. Varonis describes the loop as running inside the victim's own account, with SQS as the command channel, Lambda as the execution engine, SNS as the results channel and Bedrock as the AI command interpreter (varonis.com via fourweekmba.com). This is service abuse, not a vulnerability in Bedrock or AWS, and it requires stolen credentials with permissions to create the infrastructure and pass a role to Lambda, so IAM authorization still bounds what the operator can reach. Operational urgency is therefore limited: no patch exists or is needed, and no in-the-wild use is reported.
Technical Details
The asynchronous design removes the persistent attacker connection typical of conventional C2; each Lambda invocation lasts at most 15 minutes and leaves no continuously running implant, though the deployed cloud resources and their API activity remain investigative evidence. A generic tool specification,
execute_aws_operation, accepts a service, an operation and parameters, letting the orchestration layer issue supported AWS requests; API responses and errors feed back into the model, enabling revised and chained operations. Researchers demonstrated enumeration of EC2 instances, DynamoDB tables, databases and Lambda functions, lowering the expertise required for reconnaissance without bypassing IAM or granting new permissions. External delivery is performed by SNS after the attacker confirms the subscription, so Lambda egress restrictions alone do not cut the channel. The work extends earlier trusted-service C2 research, including Rhino Security Labs' demonstration of Cobalt Strike traffic through S3 objects. Varonis notes that CloudTrail redacts SQS and SNS message content, so observing the services in use is not the same as seeing the commands (varonis.com via fourweekmba.com).Remediation
Network blocking is insufficient because the traffic is authenticated HTTPS to legitimate AWS endpoints. Varonis recommends strict IAM least privilege and monitoring across CloudTrail, Lambda logs, SNS delivery records and Bedrock invocation logs, noting that management events expose configuration changes while relevant data events require explicit enablement. Detection should correlate infrastructure creation, queue-to-function event source mappings, role assignment (
iam:PassRole), unexpected Bedrock invocation by a Lambda role and external SNS subscriptions. Varonis highlights signals such as a Lambda role adding an external SNS subscriber and unusual Bedrock calls by a Lambda role (varonis.com via fourweekmba.com).