Hackers Weaponize AWS X-Ray Service to Work as Covert Command & Control Server
A technique has been identified where threat actors exploit Amazon Web Services' (AWS) X-Ray distributed tracing service to establish covert command and control (C2) communications. This highlights how legitimate cloud infrastructure can be used for…
A technique has been identified where threat actors exploit Amazon Web Services' (AWS) X-Ray distributed tracing service to establish covert command and control (C2) communications. This highlights how legitimate cloud infrastructure can be used for malicious purposes.
The AWS X-Ray service, intended for analyzing application performance through distributed tracing, has been adapted by security researchers into a communication channel called XRayC2. This method uses X-Ray's annotation system to transmit commands and exfiltrate data through legitimate AWS API calls to xray.[region].amazonaws.com endpoints.
Weaponizing AWS X-Ray for Covert Command and Control
The attack utilizes X-Ray’s trace segments functionality, embedding malicious payloads within normal monitoring data. Attackers use the PutTraceSegments, GetTraceSummaries, and BatchGetTraces API endpoints to create communication channels that blend with legitimate cloud traffic.
The implant uses beacon markers with system information encoded in trace annotations, including service type identifiers like "health_check" and unique instance identifiers.
This highlights how legitimate cloud infrastructure can be used for malicious purposes.
Command delivery occurs through base64-encoded payloads stored in configuration annotations, while result exfiltration uses execution_result fields within trace data structures. This technique implements custom AWS Signature Version 4 (SigV4) authentication, generating legitimate AWS API traffic that integrates with standard network logs.
The malicious communication uses randomized beacon intervals between 30 and 60 seconds and employs HMAC-SHA256 signing with access keys, following Amazon's canonical request format.
The XRayC2 toolkit requires minimal AWS permissions, using the AWSXRayDaemonWriteAccess policy along with custom permissions for trace manipulation. This reduces the attack surface compared to traditional C2 infrastructure while maintaining persistent access through cloud-native services.
Detection of this technique is challenging for security teams, as the malicious traffic resembles standard application performance monitoring activities. Organizations are advised to enhance monitoring of X-Ray API usage patterns, establish baseline metrics for trace annotation data volumes, and scrutinize unusual service interactions within AWS environments to detect potential misuse of legitimate cloud services for covert communications.
Based on reporting by Cyber Security News.