Microsoft and Amazon are my Favorite C2 Providers

The talk argues that managed cloud relay services from Microsoft and AWS make practical command-and-control channels. The speaker says many enterprises cannot block domains such as servicebus.windows.net or IoT endpoints without disrupting business tools that depend on them. In his framing, an attacker needs only code execution on a host and outbound HTTPS to reach the internet.

The talk covers three services. Azure Relay Bridge, a Microsoft open-source tool, tunnels TCP traffic through Azure's relay and can run as a persistent service. AWS IoT Secure Tunneling uses a localproxy binary, but sessions expire after 12 hours and bandwidth is capped. The speaker presents AWS IoT Core MQTT with X.509 mutual TLS as a longer-lived channel that avoids those limits. He also describes a red team test in which Azure Relay moved about a terabyte in roughly a day, and notes that the local endpoint traffic can look like a connection to localhost.

The closing section promises released Mythic agent profiles and detection guidance. Defenders should review CloudTrail and Entra ID activity for relay services and learn how these platforms behave before treating their traffic as routine.