Security Advisory: Abusing the SSM Agent as a Remote Access Trojan

Originally Published by Mitiga. Written by Ariel Szarf and Or Aspir. OverviewMitiga has discovered a new potential post-exploitation technique in AWS (Amazon Web Services): running AWS’s Systems Manager (SSM) agent as a Remote Access Trojan (RAT) on both Linux and Windows machines, controlling the endpoint using another AWS account. We’re sharing this advisory to raise awareness about this new way of abusing the SSM agent that our team developed during our ongoing research in cloud and SaaS (...

abusing access account advisory agent amazon amazon web services aws endpoint exploitation linux machines manager mitiga post-exploitation rat remote access remote access trojan running security security advisory services ssm systems trojan web web services windows written