Hackers Turn AWS X-Ray into Command-and-Control Platform

Red team researchers have developed XRayC2, a command-and-control framework utilizing Amazon Web Services (AWS) X-Ray distributed application tracing service. This tool enables covert communication channels by exploiting legitimate cloud monitoring infrastructure, making it difficult for traditional security controls to detect.

Exploiting Cloud Infrastructure for Stealth Operations

XRayC2 converts AWS X-Ray from a performance monitoring tool into a bidirectional communication platform for malicious activities. Traditional command-and-control setups often rely on attacker-controlled servers, which are susceptible to detection through suspicious domains, unknown IP addresses, and unusual network patterns.

By using AWS X-Ray's legitimate infrastructure, attackers can camouflage malicious traffic within normal application monitoring data. The technique exploits X-Ray’s annotation feature, which stores arbitrary key-value data that can be accessed through standard APIs. Communications are routed through legitimate AWS domains like xray.[region].amazonaws.com, complicating detection efforts.

The XRayC2 framework operates via a three-phase communication process:

Beacon Phase: Compromised systems submit trace segments with encoded system information, including service type markers and unique identifiers. Command Delivery Phase: Attackers send commands to compromised systems by embedding base64-encoded instructions within X-Ray annotations, which implants retrieve during polling intervals. Exfiltration Phase: Systems return command execution results by encoding output data within trace segments.

The system uses random beacon intervals between 30-60 seconds and employs legitimate AWS SigV4 authentication with HMAC-SHA256 signatures, producing authentic AWS API traffic that integrates seamlessly with standard network logs.

Setting up XRayC2 involves creating a dedicated AWS Identity and Access Management user with specific X-Ray permissions. Required permissions include "AWSXRayDaemonWriteAccess" along with custom permissions for "PutTraceSegments," "GetTraceSummaries," and "BatchGetTraces" actions.

The toolkit generates zero-dependency implants for platforms such as macOS, Linux, and Windows, requiring no additional software installation. The controller interface allows implant management, command execution, and target selection, maintaining persistent access through AWS X-Ray infrastructure.

This development underscores the evolving nature of attack techniques leveraging legitimate cloud services. Organizations are encouraged to implement comprehensive monitoring strategies that assess not only network traffic patterns but also the content and context of cloud service API calls.

Based on reporting by GBHackers.