Threat Actors Adopt NATS Messaging Infrastructure for Covert C2

Du'aine Davis

Observed in the wild

• In May, Sysdig identified a campaign centred on a new command-and-control technique, where attackers used NATS messaging servers as C2 infrastructure after exploiting CVE‑2026‑33017 (Langflow RCE). The activity targeted exposed cloud and AI development environments, enabling large-scale harvesting and validation of AWS credentials and AI API keys, with attempts to establish persistent access across compromised workloads.
• The actor deployed a “NATS-as-C2” model, replacing traditional HTTP or chat-based C2 with a legitimate publish/subscribe message broker. This allowed task distribution, result collection, and coordination across infected hosts using ACL-controlled subjects and durable queues. Supporting tooling (“KeyHunter”) combined credential scraping, validation, and automation, while blending into normal traffic, marking a notable evolution in scalable, resilient and harder-to-detect C2 architectures.
• Organisations are advised to prioritise detection of behaviour, not just payloads: monitor for unusual outbound connections to messaging brokers, enforce strict egress controls, and baseline legitimate NATS usage. Patch exposed services (e.g. Langflow), rotate credentials, and detect activity such as abnormal AWS API enumeration or system service creation. Defender telemetry should be tuned to flag anomalous network patterns and long-lived worker-like processes communicating with external brokers.

NATS-as-C2: Inside a new technique attackers are using to harvest cloud credentials and AI API keys | Sysdig