NotC2: Proof-of-Concept Framework Abuses Amazon Bedrock, SQS, Lambda and SNS as Cloud Command-and-Control

Key facts for NotC2 Bedrock C2 framework

Detection coverage for NotC2 Bedrock C2 framework

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5527 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: NotC2 - SNS HTTP/HTTPS Subscription Created by Assumed Role (Result-Return Channel)

TL-2026-5527 NotC2 result-return channel. Detects sns:Subscribe with protocol http or https issued by an assumed-role session, flagging Lambda-originated subscriptions (exec-env/AWS_Lambda user agent) as highest priority. In NotC2 the function publishes command output to an SNS topic whose external HTTPS subscription delivers it to the operator, so the Lambda never connects out directly. This is the primary indicator Varonis recommends alerting on.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1102.002, T1071, T1041
• Data sources: aws_cloudtrail:index=aws sourcetype=aws:cloudtrail, AWSCloudTrail, cloudtrail
• Severity: high
• Confidence: high

Splunk SPL

index=aws sourcetype="aws:cloudtrail" earliest=-24h eventSource="sns.amazonaws.com" eventName="Subscribe" userIdentity.type=AssumedRole NOT errorCode=*
| eval protocol=lower('requestParameters.protocol'), endpoint='requestParameters.endpoint'
| where protocol="http" OR protocol="https"
| eval endpoint_host=replace(endpoint,"^https?://([^/:]+).*$","\1")
| eval lambda_context=if(match(userAgent,"exec-env/AWS_Lambda"),"yes","no")
| eval endpoint_class=if(match(endpoint_host,"[.]amazonaws[.]com$"),"aws_hosted","non_aws")
| table _time recipientAccountId awsRegion userIdentity.arn sourceIPAddress userAgent requestParameters.topicArn protocol endpoint endpoint_host lambda_context endpoint_class
| sort - _time

Microsoft KQL

AWSCloudTrail
| where TimeGenerated > ago(24h)
| where EventSource == 'sns.amazonaws.com' and EventName == 'Subscribe' and UserIdentityType == 'AssumedRole' and isempty(ErrorCode)
| extend Req = parse_json(RequestParameters)
| extend Protocol = tolower(tostring(Req.protocol)), Endpoint = tostring(Req.endpoint), TopicArn = tostring(Req.topicArn)
| where Protocol in ('http', 'https')
| extend LambdaContext = UserAgent has 'exec-env/AWS_Lambda'
| extend EndpointHost = extract(@'^https?://([^/:]+)', 1, Endpoint)
| project TimeGenerated, RecipientAccountId, AWSRegion, UserIdentityArn, SourceIpAddress, UserAgent, TopicArn, Protocol, Endpoint, EndpointHost, LambdaContext
| order by TimeGenerated desc

Sigma

title: NotC2 - SNS HTTP or HTTPS Subscription Created by Assumed Role
id: c4d91e60-7a2b-4e83-b5f1-0d3a68e92c03
status: experimental
description: Detects an SNS Subscribe call with an http or https protocol made by an assumed-role session. NotC2 uses an external HTTPS SNS subscription to return command results to the operator. Highest priority when the user agent shows a Lambda execution environment.
references:
  - https://www.varonis.com/blog/notc2-ai-powered-c2-channel
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-09
tags:
  - attack.command-and-control
  - attack.t1102.002
  - attack.t1071
  - attack.exfiltration
  - attack.t1041
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: sns.amazonaws.com
    eventName: Subscribe
    userIdentity.type: AssumedRole
    requestParameters.protocol:
      - http
      - https
  filter_error:
    errorCode|exists: true
  condition: selection and not filter_error
falsepositives:
  - Approved webhook integrations (PagerDuty, Slack, SaaS monitoring) subscribed to SNS topics by automation roles
level: high

Known false positives:

• Approved webhook subscriptions (incident-response, chat-ops or SaaS monitoring endpoints) created by automation roles
• Infrastructure-as-code pipelines provisioning HTTPS SNS subscriptions to partner endpoints

Tuning notes: Allowlist approved endpoint hosts and the automation roles that create them (lookup on endpoint_host and userIdentity.arn). Prioritise lambda_context=yes with endpoint_class=non_aws. Remember the endpoint must confirm the subscription, so also review SNS delivery-status logs for the same topic ARN. Enable CloudTrail management events for SNS in all regions.

• 🔒 NotC2 - First-Time Bedrock Invocation From a Lambda Execution Role · unlock with TL Creds
• 🔒 NotC2 - Lambda Role Uses Bedrock and SNS Within 30 Minutes (Command-to-Result Sequence) · unlock with TL Creds
• 🔒 NotC2 - execute_aws_operation Tool Specification in Lambda or Bedrock Logs · unlock with TL Creds
• 🔒 NotC2 - Lambda Role Creates SNS Topic and Subscription at Runtime · unlock with TL Creds
• 🔒 NotC2 - SQS Queue Policy or Permission Grants SendMessage to External or Wildcard Principal · unlock with TL Creds
• 🔒 NotC2 - IAM Policy Grants Bedrock Invoke Plus SNS and SQS Runtime Permissions · unlock with TL Creds
• 🔒 NotC2 - Queue-to-Lambda Deployment Chain (CreateQueue + CreateFunction + SQS Event Source Mapping) · unlock with TL Creds
• 🔒 NotC2 - Lambda Role Combines Bedrock Invocation With Multi-Service Discovery · unlock with TL Creds

Indicators of compromise for NotC2 Bedrock C2 framework

As of 2026-11-09, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-5527.

How NotC2 Bedrock C2 framework works

NotC2 is a proof-of-concept post-compromise command-and-control framework built by Varonis Threat Labs (author credited: Or Soria, Varonis Research Team). The name derives from 'notification' (the SNS service that returns results to the operator) plus 'C2'. It distributes command delivery, execution, interpretation and result return across four native AWS services so that the traffic resembles routine cloud activity.

Architecture: (1) An external attacker server submits a natural-language command (example prompt: 'ai: list all running EC2 instances with their IPs') to an Amazon SQS queue in the compromised account. (2) A Lambda event source mapping invokes a Lambda function for each new SQS message; each invocation is limited to 15 minutes and leaves no persistent implant process. (3) The function sends the prompt to Amazon Bedrock (Converse / InvokeModel), which acts as the interpreter and translates it into AWS API calls through a single generic tool specification, execute_aws_operation, that accepts a service, an operation and parameters. API responses and errors are returned to the model, which can revise its request or chain follow-up operations. Lambda executes the resulting calls under its execution role. (4) Results are published to an Amazon SNS topic, which delivers them to an attacker-controlled HTTPS endpoint after the attacker confirms the subscription; the Lambda function never contacts the attacker directly.

Prerequisites and IAM: the technique does not bypass IAM authorization or create permissions; the attacker must already hold credentials with sufficient rights. Deployment needs, in the simplest case, sqs:CreateQueue, lambda:CreateFunction, lambda:CreateEventSourceMapping and iam:PassRole for an existing Lambda role (creating or modifying a role needs additional IAM permissions). The runtime role needs sqs:ReceiveMessage, sqs:DeleteMessage, sqs:GetQueueAttributes, sns:CreateTopic, sns:ListSubscriptionsByTopic, sns:Subscribe, sns:Publish, bedrock:InvokeModel, plus permissions for whatever target services are queried (e.g. s3:ListAllMyBuckets). Varonis notes enumeration tools such as Pacu can help find reusable roles with sufficient permissions. Researchers demonstrated enumeration of EC2 instances, DynamoDB tables, relational and NoSQL databases and Lambda functions in a live AWS environment; destructive actions (e.g. deleting S3 buckets or EC2 instances) are described as possible with sufficient permissions but were not demonstrated. The practical effect is lowering the expertise needed to use stolen cloud access and easing multi-step reconnaissance.

Detection: Network blocking is insufficient because traffic goes to legitimate AWS endpoints, and Lambda egress restrictions alone cannot stop SNS-mediated delivery. The decisive signal is an unusual relationship between otherwise legitimate services. Varonis recommends correlating CloudTrail management and data events (data events must be explicitly enabled), Lambda execution logs, SNS delivery-status logs and Bedrock model invocation logs (needed for prompt visibility, since CloudTrail redacts SQS/SNS message content). Key indicators: SNS subscriptions created by Lambda execution roles pointing at external HTTP/HTTPS endpoints; Converse/InvokeModel calls from Lambda roles that have not used Bedrock before or that begin touching unrelated services; and a short-window sequence of SQS message from an unexpected source, Lambda execution, Bedrock activity, downstream API calls and an SNS publish to an external subscriber.

Context: the source lists no CVE, CVSS, IOCs, attribution or code repository. Code has not been released, so exploitability is rated THEORETICAL on the platform scale although the PoC was demonstrated by the researchers. Severity MEDIUM is the analyst's judgment. Related cloud-native C2 research includes Rhino Security Labs' Cobalt Strike over S3, the HazyBeacon campaign (CL-STA-1020, Lambda Function URL proxying), Sonrai's AgentCore Code Interpreter global-S3 reverse shell and Upwind's AgentCore OIDC-discovery C2.

MITRE ATT&CK techniques by tactic:

Execution

T1059.009 Command and Scripting Interpreter: Cloud API; T1648 Serverless Execution

Command and Control

T1071 Application Layer Protocol; T1102.002 Web Service: Bidirectional Communication

Defense Evasion

T1078.004 Valid Accounts: Cloud Accounts

Discovery

T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery

Remediation for NotC2 Bedrock C2 framework

Immediate actions

• Alert on SNS Subscribe calls made by Lambda execution roles that target external HTTP/HTTPS endpoints
• Alert on bedrock:InvokeModel / Converse calls from Lambda roles with no Bedrock history
• Enable Bedrock model invocation logging, SNS delivery-status logging, Lambda logging and CloudTrail data events for SQS/SNS/Lambda
• Review recent CreateEventSourceMapping, CreateQueue and CreateFunction events for unexpected queue-to-function mappings

Workarounds

• Restrict Lambda internet egress where not needed (note: does not stop SNS-mediated delivery)
• Use SCPs/IAM conditions to deny Bedrock invocation from roles that do not require it

Longer-term hardening

• Enforce IAM least privilege on queue and function creation, event source mappings, iam:PassRole, Bedrock invocation and external SNS subscriptions
• Correlate infrastructure creation, role assignments, Bedrock use and SNS subscriptions across CloudTrail, Lambda, SNS and Bedrock logs
• Restrict who can create external HTTP/HTTPS SNS subscriptions, allow only approved destinations and limit publishing to intended topics

Affected and fixed versions

• Amazon Web Services — Amazon SQS, AWS Lambda, Amazon SNS, Amazon Bedrock (legitimate service abuse; no vulnerability)

Timeline of NotC2 Bedrock C2 framework

• 2026-04-22 Sonrai Security publishes related research showing global S3 access in Bedrock AgentCore Code Interpreters can serve as a bidirectional C2 channel (context for cloud-native C2 trend)
• 2026-06-03 Upwind publishes related research on a two-way C2 technique abusing Bedrock AgentCore OIDC discovery and protected resource metadata
• 2026-06-19 GBHackers reports Qualys research on HazyBeacon (CL-STA-1020), which proxies C2 through public locked-ioc-4 Function URLs (T1078.004, T1648, T1102)
• 2026-11-06 Varonis Threat Labs publishes locked-ioc-6, a PoC post-compromise C2 framework using SQS, Lambda, SNS and locked-ioc-2
• 2026-11-09 Threat added to the Threadlinqs platform in MONITORING status as new cloud C2 tradecraft
• 2026-11-09 GBHackers covers locked-ioc-6; no CVE, IOCs, attribution or in-the-wild exploitation reported

Sources cited for NotC2 Bedrock C2 framework

• NotC2: AI-Powered C2 Channel (Varonis Threat Labs) varonis.com · Research · 2026-11-06
• Global S3: Another C2 Channel for AgentCore Code Interpreters (Sonrai Security) sonraisecurity.com · Research · 2026-04-22
• No Way Out? Bypassing the AWS Data Perimeter with Bedrock AgentCore (Upwind) upwind.io · Research · 2026-06-03
• NotC2 AI-Powered Hacking Tool Turns Amazon Bedrock Into a Cloud Command-and-Control System (GBHackers) gbhackers.com · News · 2026-11-09
• HazyBeacon abuses AWS Lambda function (GBHackers) gbhackers.com · News · 2026-06-19

More in malware

• YobaLoader Campaign: DLL Sideloading in Signed OpenAI/Anthropic-Themed Binaries via Fake GitHub Repositories Delivering XMRig
• Radio Exploit Kit drive-by download campaign exploiting CVE-2016-0189 to deliver AZORult
• Bottle Exploit Kit (BottleEK) - Malvertising Campaign Targeting Japanese Users via CVE-2018-8174 and CVE-2018-15982
• Exploit kits remain active in April 2021: RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude targeting Internet Explorer (CVE-2020-0674, CVE-2021-26411, CVE-2018-8174, CVE-2018-15982, CVE-2020-1380)
• Fake Security Tools on GitHub Deliver AsyncRAT, Clipper and Infostealer via Trojan.Loader.3261 Electron Loader (Microsoft.exe)