Abusing AWS Systems Manager as a Covert C2 Channel How AWS SSM hybrid activations can be weaponized as a stealthy Living-off-the-Cloud C2 platform on non-EC2 machines — and how to detect it. May 20, 2026 Red Team Ops