Varonis Threat Labs has developed NotC2, a proof-of-concept command and control system that operates entirely within AWS infrastructure. The system leverages Amazon SQS, AWS Lambda, Amazon SNS, and Amazon Bedrock to manage operations without requiring a dedicated external server or custom network protocols.
Amazon Bedrock acts as an AI interpreter, allowing attackers to issue commands in natural language. The system automatically converts these requests into API calls. If an error occurs, the AI model analyzes the response to correct the query or suggest subsequent actions, enabling interactive reconnaissance of the cloud environment.
The system does not exploit vulnerabilities in AWS services but requires compromised credentials with sufficient permissions. Deployment involves creating SQS queues, Lambda functions, and SNS subscriptions. Lambda functions execute tasks using assigned IAM roles, while SNS delivers results to external HTTPS endpoints.
Detecting NotC2 is challenging because traffic flows through legitimate AWS services, rendering traditional IP or domain blocking ineffective. Varonis suggests monitoring CloudTrail logs for suspicious SNS subscriptions to external addresses, unusual spikes in Bedrock API calls, and specific service interaction patterns.
To mitigate risks, Varonis recommends strictly limiting IAM role permissions and restricting SNS subscriptions to approved endpoints. Security teams must shift focus from network perimeter defense to monitoring interactions between cloud resources and the identities authorized to manage them.
