XRayC2 Framework Abuses AWS for Covert C2 Attacks

Researchers have developed XRayC2, a new command-and-control framework that weaponizes the AWS X-Ray service. This technique allows attackers to establish covert communication channels by abusing the legitimate cloud monitoring infrastructure. Malicious traffic is blended with normal application data by using X-Ray's annotation feature to send commands and exfiltrate results. All communications are routed through legitimate AWS domains and authenticated with standard protocols, making detection extremely difficult. This development underscores the growing trend of attackers abusing trusted cloud services to bypass traditional security controls.