Varonis Discovers NotC2 AI-Powered C2 Framework
Original title: Researchers Uncover NotC2 AI-Powered C2 Framework That Hides Malicious Commands Inside AWS Services
NotC2 uses AWS Bedrock to interpret natural language commands and routes them via SQS, Lambda, and SNS.
Varonis Threat Labs built NotC2, a proof-of-concept C2 framework that runs entirely on native AWS services and leverages Amazon Bedrock to translate plain English prompts into cloud API calls. The attacker provides stolen AWS credentials and an SQS queue as the command input. Lambda executes the AI-generated operations, and SNS publishes results to an external HTTPS endpoint. The chain depends on the attacker's existing permissions and avoids any custom servers or protocols.
- Uses four AWS services: SQS for commands, Lambda for execution, SNS for output, and Bedrock for AI interpretation
- Works after attacker holds AWS credentials with necessary IAM rights
- Logs appear in CloudTrail, Lambda, and Bedrock invocation records
- Demonstrated on EC2 instances, DynamoDB tables, and Lambda functions
Impact: cloud command execution via stolen AWS credentials
- 1.monitor for external SNS subscriptions
- 2.restrict Lambda internet access
- 3.limit IAM permissions for Bedrock calls
- Vendors
- Varonis
- Products
- Amazon BedrockAWS
- Malware
- NotC2
- Organizations
- Varonis Threat Labs
From the original article
4 min read at cybersecuritynews.com
Varonis Threat Labs has built NotC2, a proof-of-concept command-and-control (C2) framework. It runs entirely on native AWS services and uses Amazon Bedrock to turn plain English into cloud commands. It is service abuse, not a flaw in Bedrock, and it only works after an attacker already holds AWS credentials .
By Kavichselvan · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.