WORLDTECHNotC2 Proof-of-Concept Uses Amazon Bedrock as Cloud Command-and-Control Channel
A proof-of-concept framework called NotC2 shows how stolen cloud credentials could let an attacker run command-and-control operations inside an AWS account by combining legitimate AWS services with Amazon Bedrock. The research, published on November 6 and reported by GBHackers, describes abuse of trusted services rather than a flaw in Bedrock or an initial-access exploit.
How the framework routes commands
Commands are submitted from an external server to an Amazon SQS queue inside the compromised account. An AWS Lambda event source mapping connects that queue to a function, which runs when messages arrive. Because the design is asynchronous, it removes the persistent connection to attacker infrastructure that conventional command-and-control setups depend on.
Lambda processes each request under its execution role. Results are published to an Amazon SNS topic, and SNS performs the delivery to an attacker-controlled HTTPS endpoint once the attacker confirms the subscription. The Lambda function itself does not need to contact the attacker directly.
Natural-language control through Bedrock
Amazon Bedrock provides a natural-language interface. Rather than writing a detailed AWS CLI query, an operator can ask in plain language, for example to list all running EC2 instances with their IP addresses. A generic tool specification, execute_aws_operation, accepts the chosen service, operation and parameters, so the orchestration layer can run supported AWS requests.
Responses and errors can be fed back into the model, which allows revised requests and chained operations. The researchers demonstrated enumeration of EC2 instances, DynamoDB tables, databases and Lambda functions.
What defenders should take from it
Each Lambda invocation lasts no longer than 15 minutes, and no continuously running implant process is left behind. The deployed cloud resources and their activity nonetheless remain potential evidence for investigators. The architecture moves attacker infrastructure into managed services rather than making it invisible.
The central implication is operational: defenders cannot identify malicious activity simply by trusting AWS destinations or authenticated API requests. The researchers also note that deployment and runtime access are separate security boundaries.
Open questions
- Has the technique been observed in real attacks outside the research?
- Which controls would detect the subscription and queue activity described?