NotC2 AI-Powered Framework Uses AWS Bedrock for Cloud C2
First merged summary.
NotC2 C2 framework routes natural language commands via AWS services using Bedrock.
Varonis researchers developed NotC2, a proof-of-concept C2 framework that combines AWS services with Amazon Bedrock to interpret natural language commands. Attackers submit commands to an SQS queue using stolen AWS credentials, with Lambda executing AI-generated operations and SNS publishing results to an external HTTPS endpoint. The system relies on existing IAM permissions, avoids custom servers or protocols, and logs in CloudTrail, Lambda, and Bedrock records. It has been demonstrated on EC2 instances, DynamoDB tables, and Lambda functions.
- SQS, Lambda, SNS enable asynchronous C2 with Bedrock AI interpretation
- Relies on attacker IAM permissions, no bypass required
- Logs appear in CloudTrail, Lambda, and Bedrock records
- Demonstrated on EC2, DynamoDB, and Lambda functions
- Built by Varonis Threat Labs
Timeline
dated events in the reporting · oldest first- Nov 9, 2026Varonis researchers uncover NotC2 C2 framework · Cyber Security News
- Nov 9, 2026GBHackers reports NotC2 as AI-powered cloud C2 using Bedrock · GBHackers
What each outlet adds
beyond the shared facts- Cyber Security NewsVaronis developed NotC2 and demonstrated on EC2 DynamoDB Lambda
- GBHackersNotC2 turns Amazon Bedrock into C2 system without IAM bypass
- Products
- Amazon BedrockAWS
- Malware
- NotC2
- Organizations
- Varonis Threat Labs
Coverage
oldest first · one row per article · UTC- · 10h ago
GBHackersFirst report
NotC2 turns Amazon Bedrock into cloud command-and-control
NotC2 PoC uses AWS services and Amazon Bedrock for post-compromise C2 operations without bypassing IAM.
- · 5h ago
Cyber Security News
Varonis Discovers NotC2 AI-Powered C2 Framework
NotC2 uses AWS Bedrock to interpret natural language commands and routes them via SQS, Lambda, and SNS.