Hackers Abuse AWS X-Ray as Covert Command-and-Control Channel

A new framework, XRayC2, demonstrates how attackers can repurpose Amazon Web Services’ X-Ray distributed tracing service into a stealthy command-and-control (C2) channel, bypassing conventional network security controls with authentic AWS API traffic.

Exploiting Cloud Infrastructure for Stealth Operations

Traditional C2 setups depend on attacker-controlled servers and generate detectable anomalies—suspicious domains, unknown IP addresses, irregular traffic patterns, and certificate oddities.

XRayC2 instead leverages AWS X-Ray’s built-in annotation feature to embed encrypted key-value data within trace segments, routing all communications through legitimate AWS domains such as xray.<region>.amazonaws.com.

This method blends malicious payloads with standard monitoring data, thwarting detection tools that focus solely on traffic origin or volume.

The toolkit uses three distinct phases:

• Beacon Phase: Compromised hosts submit initial trace segments containing encoded metadata (service markers, implant ID, OS details).
• Command Delivery Phase: Operators push base64-encoded instructions into X-Ray annotations, which implants retrieve during routine polling.
• Exfiltration Phase: Execution outputs are encoded back into trace segments and harvested by the controller.
  Randomized beacon intervals (30–60 seconds) combined with AWS SigV4 authentication produce genuine CloudWatch logs indistinguishable from benign traffic.

Framework Deployment and Capabilities

Deploying XRayC2 requires an AWS Identity and Access Management user provisioned with “AWSXRayDaemonWriteAccess” and custom permissions for PutTraceSegments, GetTraceSummaries, and BatchGetTraces across all resources.

The toolkit auto-generates zero-dependency implants for macOS, Linux, and Windows, enabling straightforward deployment without additional software.

The controller UI offers comprehensive implant management, listing active hosts, selecting targets, issuing commands, and viewing implant status while maintaining persistence via X-Ray’s infrastructure.

Implications and Detection Strategies

XRayC2’s abuse of a trusted cloud service highlights the evolution of stealthy attack vectors.

must expand monitoring beyond network-level indicators to include:

• API Call Context Analysis: Inspect annotation payload sizes, frequencies, and parameter usage.
• Trace Metadata Correlation: Compare trace maps against known service architectures to spot anomalies.
• Behavioral Baselines: Establish normal X-Ray usage patterns and flag deviations in trace counts or content.

Combining these measures with traditional threat intelligence and anomaly detection solutions will be critical for identifying and mitigating cloud-based C2 operations.

Cyber Awareness Month Offer: Upskill With 100+ Premium Cybersecurity Courses From EHA's Diamond Membership: Join Today