Hackers Turn AWS X-Ray into Command-and-Control Platform

Red team researchers have unveiled XRayC2, a sophisticated command-and-control framework that weaponises Amazon Web Services’ X-Ray distributed application tracing service to establish covert communication channels, according to reporte. The toolkit transforms AWS X-Ray from a performance monitoring tool into a bidirectional platform for malicious activities, enabling attackers to blend their traffic with normal application monitoring data and write and query arbitrary data through X-Ray’s annotation feature.

All communications route through legitimate AWS domains like xray.[region].amazonaws[.]com, making detection significantly more challenging. The framework operates through a three-phase process: an initial beacon phase where compromised systems submit trace segments containing encoded system information, a command delivery phase where base64-encoded instructions are embedded within X-Ray annotations, and a final exfiltration phase that returns results via trace segments.

Settings include random beacon intervals of 30-60 seconds and the use of AWS SigV4 authentication with HMAC-SHA256 signatures, producing authentic AWS API traffic that blends with logs. Setting up XRayC2 requires a dedicated AWS IAM user with the AWSXRayDaemonWriteAccess policy and permissions for PutTraceSegments, GetTraceSummaries and BatchGetTraces across all resources.