Ghost in the Cloud: Weaponizing AWS X-Ray for Command & Control

Ghost in the Cloud describes how attackers can weaponise AWS X-Ray as a covert bidirectional command-and-control channel by abusing legitimate cloud tracing infrastructure. The piece explains that X-Ray annotations can store arbitrary key-value data and that the service exposes APIs to write and query data, enabling an implant to beacon and receive commands through signed API traffic.

The communication flow shows a three-phase process: implant beacon, command delivery from controller to implant, and result exfiltration back to the controller, with a random beacon interval of 30–60 seconds. The implant signs API requests with manual AWS SigV4 authentication using an AWS access key and secret, creating apparently normal AWS traffic.

Setup steps involve creating an IAM user named XRay with AWSXRayDaemonWriteAccess, plus a custom policy granting xray:PutTraceSegments, xray:GetTraceSummaries and xray:BatchGetTraces. The article also provides a build process for XRayC2, details of the standalone implants, and a sample run showing a host returning hostname as the command output. According to Security Affairs, the technique leverages AWS X-Ray’s legitimate infrastructure to blend in with regular logs.