Abuse of AWS Systems Manager (SSM) Agent as a Remote Access Trojan
Abuse of AWS Systems Manager (SSM) Agent as a Remote Access (TL-2026-1644), also tracked as SSM Agent Hijacking, is a medium-severity ttp threat, first published 2026-07-22. It has no confirmed attribution, affects Amazon Web Services AWS Systems Manager Agent (SSM Agent), maps to 15 MITRE ATT&CK techniques (T1036, T1059, T1078.004), and is covered by 9 detection rules and 16 indicators of compromise.
Key facts for TL-2026-1644
- Threat ID
- TL-2026-1644
- Also known as
- SSM Agent Hijacking, AWS SSM Agent RAT
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- TTP
- First published
- 2026-07-22
- Last reviewed
- 2026-07-22
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- cloud infrastructure, technology, any aws ec2 customer environment
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in Abuse of AWS Systems Manager (SSM) Agent as a Remote Access
Malware and tooling: AWS Systems Manager Agent (SSM Agent)
Mitiga researchers documented a post-exploitation technique that repurposes the legitimate, Amazon-signed AWS Systems Manager (SSM) Agent on Linux and Windows EC2 hosts into a Remote Access Trojan. Attackers with root/administrator access hijack the agent into hybrid mode under an attacker-controlled AWS account, run a second parallel agent process, or proxy SSM traffic through an attacker-controlled endpoint, then use built-in RunCommand/StartSession features for command-and-control while evading EDR tools that trust the signed binary.
How Abuse of AWS Systems Manager (SSM) Agent as a Remote Access works
In a July 31, 2023 security advisory, Mitiga researchers detailed a living-off-the-land post-exploitation technique abusing the AWS Systems Manager (SSM) Agent, a signed, first-party binary pre-installed on most default Amazon Machine Images (AMIs) and widely deployed across AWS EC2 fleets for patch management, command execution, and session access. Because the SSM Agent binary is Amazon-signed and near-universally allowlisted by antivirus and EDR products (Mitiga noted 0 of 71 VirusTotal engines flagged it as malicious), an attacker who has already obtained root (Linux) or Administrator (Windows) level access on an EC2 instance can repurpose the existing, trusted agent into a full remote-access channel instead of dropping custom malware.
Three distinct exploitation scenarios were documented:
1. **Hijacking the original agent (hybrid-mode re-registration).** The attacker stops the running amazon-ssm-agent service, re-registers it in SSM 'hybrid activation' mode using an activation code/ID generated in an AWS account they control (`amazon-ssm-agent -register -code <ACTIVATION_CODE> -id <ACTIVATION_ID> -region <REGION>`), and restarts the service. The instance now takes RunCommand and Session Manager (StartSession) instructions from the attacker's AWS account instead of, or in addition to, the legitimate owning account, bypassing the EC2 instance metadata service (IMDS) for identity. This method is persistent across reboots.
2. **Running a second, parallel SSM Agent process.** Rather than hijacking the original agent (which could disrupt legitimate management and tip off defenders), the attacker launches an independent second amazon-ssm-agent process registered to their own AWS account, isolated from the original using Linux namespaces (on Linux) or a modified environment/registry context (on Windows), while the legitimate agent continues operating normally and undisturbed. This requires only a non-root/non-admin foothold to execute in some configurations described by the researchers, though full agent control still assumes elevated access to install/run the second binary persistently.
3. **Mock/proxy SSM server.** The attacker modifies the `http_proxy`/`https_proxy` environment variables (or equivalent proxy configuration) consumed by the SSM Agent so its command-and-control traffic is routed through an attacker-controlled proxy server rather than direct to AWS Systems Manager endpoints, which can also route traffic outside AWS entirely and reduce AWS-side visibility into the C2 channel.
In all scenarios the attacker gains a fully functional, Amazon-signed RAT capable of arbitrary command execution (RunCommand), interactive shell access (Session Manager StartSession), and file transfer, providing persistence, defense evasion, and command-and-control without deploying any additional flagged malware. Potential downstream impact includes data theft, ransomware deployment, cryptomining, and lateral movement across the compromised environment. AWS's public response characterized the behavior as expected/by-design ('software and systems are behaving as designed and there is no need for customers to take any action'), placing the burden of detection and prevention on defenders via SIEM/EDR tuning and network-layer restriction (VPC endpoint policies) rather than a product fix, and Mitiga's detection guidance and AWS's mitigation guidance were published together with the advisory. No CVE was assigned, consistent with this being a technique abusing intended agent functionality rather than a software vulnerability.
MITRE ATT&CK techniques used in TL-2026-1644
Defense Evasion
T1036 Masquerading; T1127 Trusted Developer Utilities Proxy Execution
Execution
T1059 Command and Scripting Interpreter; T1569.002 Service Execution
Privilege Escalation
Command and Control
T1090.002 External Proxy; T1219 Remote Access Tools; T1219.002 Remote Desktop Software
persistence
T1098 Account Manipulation; T1098.001 Additional Cloud Credentials
Persistence
T1133 External Remote Services
Impact
T1486 Data Encrypted for Impact; T1489 Service Stop
Discovery
defense-impairment
Affected products and versions in Abuse of AWS Systems Manager (SSM) Agent as a Remote Access
- Amazon Web Services — AWS Systems Manager Agent (SSM Agent)
Vulnerable versions: all versions supporting hybrid activation and proxy configuration, pre-installed on default AMIs, Linux and Windows - Amazon Web Services — Amazon EC2 (Linux and Windows instances with SSM Agent installed)
Vulnerable versions: any EC2 instance with amazon-ssm-agent installed and running
Remediation for Abuse of AWS Systems Manager (SSM) Agent as a Remote Access
Immediate actions
- Remove the amazon-ssm-agent binary path from antivirus/EDR allowlists so behavioral analysis and process monitoring apply to it like any other binary
- Audit all EC2 instances for unexpected SSM hybrid-mode registrations or multiple concurrent amazon-ssm-agent processes
- Review CloudTrail for Session Manager and RunCommand API calls (StartSession, SendCommand, CreateActivation) originating from unexpected or unrecognized AWS account principals
- Search hosts for unexpected instance-data directories under /var/lib/amazon/ssm/i-[instanceID] (Linux) or C:\ProgramData\Amazon\SSM\InstanceData\i-[instanceID] (Windows) that do not correspond to the instance's own ID
Workarounds
- Configure AWS Systems Manager VPC endpoint policies to restrict accepted commands to the instance's original AWS account or AWS Organization only, using IAM global condition keys (e.g. aws:PrincipalAccount / aws:ResourceOrgID) on the SSM VPC endpoint policy
- Deploy AWS Systems Manager over VPC endpoints rather than the public SSM service endpoint to reduce exposure to attacker-controlled proxy redirection
Longer-term hardening
- Implement SIEM/SOAR detection content for suspicious SSM agent registration flags (-register, -code, -id, -region) and for multiple simultaneous amazon-ssm-agent processes
- Monitor and alert on http_proxy/https_proxy environment variable changes on hosts running the SSM Agent
- Continuously monitor IAM policies and permissions boundaries for unauthorized principals with ssm:SendCommand, ssm:StartSession, or ssm:CreateActivation permissions
- Bake EDR/AV visibility into the SSM Agent process itself as part of standard EC2 hardening baselines
Timeline of Abuse of AWS Systems Manager (SSM) Agent as a Remote Access
- Mitiga's advisory references earlier related community research from around January 2021 on abusing legitimate cloud agent tooling for post-exploitation access, which informed the SSM-specific research
- Mitiga states findings were shared with AWS security prior to public disclosure
- Mitiga publishes the security advisory 'Abusing the SSM Agent as a Remote Access Trojan,' detailing hybrid-mode hijacking, parallel-agent, and proxy-abuse exploitation scenarios along with detection guidance
- BleepingComputer publishes coverage of the Mitiga findings, summarizing AWS's public response that the SSM Agent is 'behaving as designed'
- Community researcher Muhammad Faisal publishes a Sigma detection rule ('Potential Amazon SSM Agent Hijacking') tagged to MITRE ATT&CK T1219.002, targeting indicators from the Mitiga report
- The Hacker News, CSO Online, Infosecurity Magazine, Help Net Security, and SiliconANGLE publish independent coverage summarizing the technique and AWS/Mitiga mitigation guidance
- The community Sigma rule for SSM Agent hijacking is promoted from experimental to 'test' status
- The Sigma rule is updated to align its MITRE ATT&CK T1219.002 tagging with the current technique specification
Sources cited for Abuse of AWS Systems Manager (SSM) Agent as a Remote Access
- Mitiga Security Advisory: Abusing the SSM Agent as a Remote Access Trojan
- Researchers Uncover AWS SSM Agent Misuse as a Covert Remote Access Trojan
- Amazon's AWS SSM agent can be used as post-exploitation RAT malware
- Mitiga report reveals unique way to abuse AWS Systems Manager agent
- Researchers warn Amazon's AWS System Manager agent can be used as a RAT
- Threat Actors Use AWS SSM Agent as a Remote Access Trojan
- Attackers can turn AWS SSM agents into remote access trojans
- Sigma Rule: Potential Amazon SSM Agent Hijacking
Threats related to Abuse of AWS Systems Manager (SSM) Agent as a Remote Access
Detection coverage for TL-2026-1644
As of 2026-07-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1644 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.