Security researchers at Mitiga have discovered a technique for using AWS Systems Manager (SSM) Agent as a remote access trojan (RAT). The technique allows for persistent command and control of a compromised host by an attacker from within another AWS account.
SSM Agent is software that allows administrators to configure, manage, and update AWS resources through the Systems Manager service. It can be installed on a various systems, including Amazon Elastic Compute Cloud (EC2) instances, edge devices, on-premises servers, and virtual machines.
In their report, Mitiga outlined two potential attack scenarios. The first involves hijacking the original SSM agent process and registering it to work in “hybrid” mode with a different AWS account. The second approach consists of running another SSM agent process on the compromised host that communicates directly with the attacker’s AWS account.
According to the researchers, there are several benefits to using SSM Agent as a RAT:
- The SSM Agent binary is signed by Amazon and trusted by antivirus (AV) and endpoint detection and response (EDR) products.
- SSM Agent is present in many Amazon Machine Images (AMIs), which reduces the attack footprint by eliminating the need to upload and execute additional malicious software.
- An attacker can control a compromised SSM agent from a separate AWS account, making detection more difficult.
Owners of impacted AWS accounts are recommended to remove SSM Agent from any allow lists configured for AV or EDR solutions. AWS security also recommends restricting access to hosts running SSM Agent to the original AWS account by using a Virtual Private Cloud (VPC) endpoint.