FlagThis — Daily Cybersecurity Intelligence Briefing

Varonis Threat Labs disclosed NotC2, a proof-of-concept C2 framework that weaponizes Amazon Bedrock to translate plain-text instructions into AWS API calls. After obtaining valid IAM credentials, attackers execute post-compromise command and control entirely through native AWS services—including Lambda, SNS, SQS, S3, and CloudWatch—blending malicious traffic with legitimate control-plane activity. Because this is service abuse rather than an AWS vulnerability, no patch exists. Detection requires monitoring CloudTrail logs and Bedrock API behavior rather than traditional network-based C2 indicators.

TWINLOOT is a Python-based enterprise-native implant that weaponizes Microsoft 365 services for command-and-control. Attackers use external Microsoft Teams tenant messaging to impersonate IT support and deliver a PowerShell execution chain. The implant leverages SharePoint dead-drops for C2 and exfiltration, abuses Teams TURN relays, and controls headless Microsoft Edge via Chrome DevTools Protocol to blend traffic with legitimate browser activity. It harvests credentials via fake Windows lock-screen prompts and enables lateral movement through an integrated SOCKS5 proxy. Observed across at least three independent threat actors, this TTP cluster bypasses perimeter controls by routing malicious traffic through trusted M365 infrastructure.