Hackers Turn AWS X-Ray into Command-and-Control Platform

Red team researchers have unveiled XRayC2, a sophisticated command-and-control framework that weaponizes Amazon Web Services’ X-Ray distributed application tracing service to establish covert communication channels.

This innovative technique demonstrates how attackers can abuse legitimate cloud monitoring infrastructure to bypass traditional network security controls.

Diagram explaining command and control (C2) servers used by attackers to control infected devices and exfiltrate data 

Exploiting Cloud Infrastructure for Stealth Operations

The XRayC2 toolkit transforms AWS X-Ray from a performance monitoring tool into a bidirectional communication platform for malicious activities, as per reported by Security Researcher.

Traditional command-and-control infrastructure typically relies on attacker-controlled servers, which create numerous detection opportunities including suspicious domains, unknown IP addresses, unusual network patterns, and certificate anomalies.

Visual overview of various cyber attack vectors targeting AWS cloud services illustrated by service icons and attack names 

By leveraging AWS X-Ray’s legitimate cloud infrastructure, attackers can blend their malicious traffic with normal application monitoring data.

The technique exploits X-Ray’s annotation feature, which allows storing arbitrary key-value data that can be written and queried through standard APIs.

All communications route through legitimate AWS domains like xray.[region].amazonaws.com, making detection significantly more challenging.

The XRayC2 framework operates through a sophisticated three-phase communication process.

During the initial beacon phase, compromised systems establish their presence by submitting trace segments containing encoded system information including service type markers, unique implant identifiers, and operating system details.

AWS CloudWatch X-Ray trace map showing distributed service architecture with demo-web-api and ECS container workers 

The command delivery phase enables attackers to send instructions to compromised systems. Controllers embed base64-encoded commands within X-Ray annotations, which implants retrieve during regular polling intervals.

The final exfiltration phase allows compromised systems to return command execution results by encoding output data within trace segments.

The system implements random beacon intervals between 30-60 seconds and uses legitimate AWS SigV4 authentication with HMAC-SHA256 signatures.

This creates authentic AWS API traffic that seamlessly integrates with standard network logs, making detection extremely difficult.

Setting up XRayC2 requires creating a dedicated AWS Identity and Access Management user with specific X-Ray permissions.

Operators must attach the “AWSXRayDaemonWriteAccess” policy along with custom permissions allowing “PutTraceSegments,” “GetTraceSummaries,” and “BatchGetTraces” actions across all resources.

Comparison of red teaming and penetration testing frameworks, purposes, and activities in cybersecurity 

The toolkit generates zero-dependency implants for multiple platforms, including macOS, Linux, and Windows executables.

These standalone implants require no additional software installation, making deployment straightforward.

The controller interface provides comprehensive implant management capabilities, including listing active systems, selecting targets, sending commands, and viewing detailed implant information.

Once deployed, operators can execute system commands remotely while maintaining persistent access through the AWS X-Ray infrastructure.

The framework’s design ensures reliable communication even in heavily monitored environments where traditional command-and-control methods would be quickly detected.

This development highlights the ongoing evolution of attack techniques that abuse legitimate cloud services, emphasizing the need for organizations to implement comprehensive monitoring strategies that examine not just network traffic patterns but also the content and context of cloud service API calls.

Cyber Awareness Month Offer: Upskill With 100+ Premium Cybersecurity Courses From EHA's Diamond Membership: Join Today