{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/aws-iot-core/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AWS IoT Core"],"_cs_severities":["high"],"_cs_tags":["command-and-control","linux","aws","c2"],"_cs_type":"advisory","_cs_vendors":["Amazon"],"content_html":"\u003cp\u003eAdversaries are increasingly using AWS IoT Core as a covert command-and-control (C2) channel for compromised Linux hosts. By provisioning an attacker-controlled broker and deploying an agent - typically running from non-standard or writable directories such as /tmp, /dev/shm, or hidden user paths - the threat actor can communicate with the compromised asset via MQTT over TLS. This method allows for the relay of commands, execution results, and file transfers without requiring a direct connection to a dedicated operator backend server. Because AWS IoT endpoints are publicly resolvable and facilitate legitimate cloud traffic, this communication often blends in with standard business operations. The use of port 443 or 8883 for MQTT traffic further complicates network-based detection, necessitating focus on the correlation between endpoint behavior, specific process execution paths, and cloud-based infrastructure resolution.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe adversary gains initial access to the Linux host and executes a malicious binary or script from a high-entropy or writable path like /tmp or a hidden user directory.\u003c/li\u003e\n\u003cli\u003eThe malicious process retrieves the target AWS IoT Core data endpoint, which is uniquely formatted for the attacker's specific AWS account and region.\u003c/li\u003e\n\u003cli\u003eThe process initiates a DNS query to resolve the account-specific AWS IoT data endpoint (e.g., \u0026lt;prefix\u0026gt;-ats.iot.\u0026lt;region\u0026gt;.amazonaws.com).\u003c/li\u003e\n\u003cli\u003eUpon receiving the resolved IP addresses from the DNS request, the process initiates an outbound TCP connection to one of these addresses.\u003c/li\u003e\n\u003cli\u003eThe connection is established over standard ports 443 or 8883, which are used for MQTT over TLS.\u003c/li\u003e\n\u003cli\u003eThe agent performs an MQTT handshake and subscribes to specific topics for C2 instruction and command execution.\u003c/li\u003e\n\u003cli\u003eThe attacker issues commands through the AWS IoT broker, which the agent executes, returning the output via the established MQTT channel.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful deployment of this C2 mechanism enables persistent, covert remote access to compromised infrastructure. Organizations targeted include those running Linux-based environments where unauthorized agents can be introduced via exploitation or credential compromise. If unchecked, this activity facilitates data exfiltration, lateral movement, and arbitrary command execution while bypassing traditional perimeter security controls that rely on blocking known malicious IP infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for detection engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma-compatible detection logic to identify processes running from suspicious paths that resolve and connect to AWS IoT infrastructure.\u003c/li\u003e\n\u003cli\u003eImplement network monitoring to flag unexpected outbound connections to known AWS IoT data endpoint address patterns, especially when initiated by non-standard processes.\u003c/li\u003e\n\u003cli\u003eEnrich security event telemetry with packet-level inspection to identify the ALPN value \u0026quot;x-amzn-mqtt-ca\u0026quot; on port 443 connections, which indicates AWS IoT MQTT usage.\u003c/li\u003e\n\u003cli\u003eReview file system integrity and execution policies to prevent the execution of binaries from volatile or user-writable directories.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T23:30:58Z","date_published":"2026-10-20T23:30:58Z","id":"https://feed.craftedsignal.io/briefs/2026-10-suspicious-linux-aws-iot-c2/","summary":"Adversaries may leverage AWS IoT Core as a command-and-control rendezvous point by deploying agents on Linux hosts that utilize MQTT over TLS to relay commands through cloud-based brokers.","title":"Suspicious Linux process connection to AWS IoT Core MQTT","url":"https://feed.craftedsignal.io/briefs/2026-10-suspicious-linux-aws-iot-c2/"}],"language":"en","title":"CraftedSignal Threat Feed - AWS IoT Core","version":"https://jsonfeed.org/version/1.1"}