In AWS, SSM is often preinstalled on popular Amazon Machine Images, leading to a high possibility that many existing EC2 instances are running the SSM agent.

Threat actors have been observed using Amazon Web Services (AWS) 's System Manager (SSM) agent as a Remote Access Trojan (RAT) on Linux and Windows machines. According to a new security report ...