FOURWEEKMBA EXPLAINER · FROM THE NEWSROOM · UPDATED 14 NOVEMBER 2026
The short answer: Command-and-control, or C2, is the channel an attacker uses to send orders to systems they have broken into and get results back. Cloud AI command-and-control moves that whole channel inside the victim’s own cloud account, built from normal services, with an AI model turning plain-English requests into cloud commands. In November 2026, Varonis Threat Labs showed a proof of concept, NotC2, built on four AWS services: SQS, Lambda, SNS and Bedrock. It does not break into AWS. It needs credentials the attacker already stole, and it can only do what those credentials allow. What changes is where defenders must look: not at the network, but at the account’s own logs and permissions.
Free to share with a link to this page. Concept diagram based on Varonis Threat Labs’ post of 6 November 2026. It shows how the parts relate, not how to build them.
After attackers get into a system, they need a way to keep talking to it. That channel is command-and-control. Old-style C2 used custom servers and odd network traffic, which security tools learned to spot and block.
So attackers moved into services everyone uses. MITRE ATT&CK, the industry’s catalogue of attack techniques, lists this as “Web Service” (T1102): attackers “may use an existing, legitimate external Web service” to relay data, and cloud services “may give a significant amount of cover.” Varonis lists past examples: Telegram and Discord bots, Slack webhooks, Pastebin and GitHub Gists, and cloud storage such as Amazon S3, Google Drive and OneDrive. Blocking these is hard, because businesses depend on them.
Earlier research used one cloud service at a time. Varonis asked what happens if the whole loop runs on AWS, including the expertise the attacker would normally supply.
How the cloud AI version works, in concept
In Varonis’s NotC2, each AWS service plays one part. The name stands for “notification” C2, after the service that carries results back.
Amazon SQS, the inbox. A message queue receives the attacker’s commands.
AWS Lambda, the worker. A serverless function runs each command, using the permissions of its “execution role,” the identity AWS gives the function.
Amazon Bedrock, the interpreter. An AI model “translates the attacker’s natural-language commands into AWS API calls.” It can also chain several steps together.
Amazon SNS, the outbox. A notification topic sends results to an outside web address. Lambda never connects to the attacker’s server directly.
Varonis ran NotC2 against a live AWS environment. It says that, with enough permissions, an attacker could also delete resources such as storage buckets or servers.
What the AI changes, and what it does not
The AI does not add new powers. “The model stays within the identity’s assigned permissions,” Varonis writes. The whole operation “stands or falls on the permissions of the compromised credentials.” The attacker may first need to escalate privileges or find stronger credentials.
What the AI changes is skill. Instead of exact command syntax, the attacker can ask in plain English, for example to list running servers or “show me what I have access to.” In Varonis’s words, it “lowers the expertise required to use compromised cloud access and makes multi-step reconnaissance easier, without granting permissions the attacker does not already possess.”
The weak point is the function’s role. “A Lambda execution role that accumulates all of this is, functionally, a backdoor with an AI assistant,” Varonis writes.
Why network tools miss it
All the traffic is encrypted, goes to trusted AWS addresses and is signed with valid credentials. The usual clues, such as suspicious domains, unknown IP addresses, custom protocols and regular “beaconing,” largely vanish. Each Lambda run lasts no more than 15 minutes and leaves no running process.
“The signal moved, it did not disappear,” Varonis writes. It now sits in the account’s own logs. Some of those logs are off unless someone turns them on.
Defaults from AWS documentation. Varonis notes that CloudTrail redacts SQS and SNS message content, so seeing a service in use is not the same as seeing the command.
Per AWS: CloudTrail records management events by default and keeps a 90-day event history. Data events, which show the message flow, are off by default and cost extra. Bedrock model invocation logging, which captures prompts and responses, “is disabled by default.” SNS delivery status logging has to be configured. Lambda sends function logs to CloudWatch by default, if its role has permission to write them.
Three signals defenders watch
Varonis lists three detection opportunities. None is proof on its own; the pattern is what matters.
1. A Lambda role adds an external SNS subscription. A subscription created by a Lambda execution role that points to an outside web address should be investigated. Normal functions rarely create new external subscriptions while running.
2. Bedrock use spikes under a Lambda role. A sudden rise in model calls by a function’s role is a warning sign, especially if that role never used Bedrock before. It is stronger if the same role starts touching unrelated services.
3. The full sequence in a short window. With the right logs on, defenders can link a queue message from an unexpected source to a function run, Bedrock activity, other API calls and a publish to an outside subscriber, all within a short period.
Two controls that break the chain
Control
What it means
Why it works
Strict least privilege
Stop identities and function roles from piling up permissions they do not need. Pay special attention to who can create queues and functions, connect them, hand powerful roles to functions, call Bedrock and create external subscriptions. AWS recommends least-privilege permissions and its IAM Access Analyzer tool to build policies from actual use.
Varonis calls it “the highest-leverage control.” If a stolen identity cannot assemble the parts, or the function’s role cannot reach other resources, the chain fails.
Restrict outside paths
Limit internet access for functions that do not need it. Control who can create or change external HTTP and HTTPS subscriptions, allow only approved destinations, and keep functions publishing to their intended topics. AWS documents topic policies that limit subscriptions.
Network egress rules alone do not stop it, because SNS makes the outside delivery. Without an external subscriber, the results channel fails.
Varonis sums it up: “Block any one of those steps and the chain fails.”
What is not established
NotC2 is a vendor’s own proof of concept. The Varonis post does not report attackers using it and quotes no response from AWS. The detection signals are Varonis’s recommendations, not AWS guidance. This page explains the idea for defenders; it is not a security audit of any account.
FAQ
What is command-and-control (C2) in cyber security?
It is the channel attackers use to send instructions to systems they have compromised and to receive data back.
What is NotC2?
A proof-of-concept framework from Varonis Threat Labs, published on 6 November 2026. It builds a C2 loop from Amazon SQS, AWS Lambda, Amazon SNS and Amazon Bedrock inside an AWS account the attacker already controls.
Is this a flaw in AWS or Bedrock?
No vulnerability is claimed. NotC2 assumes the attacker already holds AWS credentials, and the AI model stays within those credentials’ permissions.
Why does the AI part matter?
It lowers the skill needed. The attacker can ask in plain English, and the model turns that into cloud API calls and can chain steps.
How can defenders detect cloud AI command-and-control?
Watch for a function’s role creating external SNS subscriptions, unusual Bedrock calls from a function’s role, and the full queue-to-function-to-model-to-notification sequence in a short window. Turn on the logs that show it, such as Bedrock invocation logging and CloudTrail data events.
What is the most important control?
Strict least privilege on identities and function roles, which Varonis calls the highest-leverage control, followed by limits on external subscriptions and outbound paths.
Sources: Or Soria, “NotC2: How We Built an AI-Powered C2 Channel With AWS Services”, Varonis Threat Labs, 6 November 2026; AWS documentation: CloudTrail management events, data events and event history; Amazon Bedrock model invocation logging; Amazon SNS message delivery status and access policy examples; AWS Lambda logging and execution roles; IAM security best practices; MITRE ATT&CK T1102 Web Service; FourWeekMBA newsroom reports linked above. Quotes are verbatim from the sources named. This page describes the research at a high level for defenders and contains no attack instructions.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
