Attackers Are Running Their C2 on Your Cloud, and You Are Paying for It

Attackers are running their command-and-control server on your cloud. And you are paying for it. Out of your own account.

What does that mean? Somebody breaks into your cloud environment. But instead of standing up a command-and-control server on some dubious VPS in Russia or Romania, they open a Lambda function in your AWS. Quiet, clean, entirely legitimate.

The traffic? Looks like ordinary organisational activity. The address? Belongs to Amazon. The invoice? Arrives with you at the end of the month.

It is like a burglar breaking into your house, ordering himself a pizza on your phone, and you paying for it without noticing.

The genius of it is the simplicity

A Lambda function needs no server. There is no fixed IP to block. There is no suspicious infrastructure for the SIEM systems to catch. The whole architecture runs on a service you yourself use every day.

Think about it from the attacker's point of view. Why pay for my own server when I can use yours? Why risk exposing my IP address when everything goes through Amazon? Why build infrastructure when the victim builds it for me?

This is not a bug. It is not a technical weakness. It is entirely legitimate use of a cloud service - and that is exactly what makes it so hard to identify.

Now double it

The attacker is not only attacking you. They are using your Lambda to attack somebody else. You are not just the victim; you are the unwitting accomplice. Your infrastructure is the weapon, and your account is paying for the ammunition.

What actually bothers me

Most of the organisations I know do not monitor the creation of new Lambda functions. There is no alert on it. There is nobody checking. There is no awareness at all that this is an attack vector.

They invest millions in firewalls and network defence - but the cloud? The cloud is treated like no-man's-land.

And if you are thinking this is not relevant to you because you do not use Lambda, think again. Every serverless service is exposed to this. Every cloud environment with loose permissions is a candidate.

If you are not monitoring what happens in your cloud account at the level of functions and services, you may be funding an attack without knowing it.

I first shared a version of this as a LinkedIn post on 2026-06-26. It is republished here, lightly edited, so it is easier to find and reference. — Erez Metula