Mitiga researchers found that the AWS SSM agent could be hijacked and turned into a remote access trojan that is difficult to detect.

In AWS, SSM is often preinstalled on popular Amazon Machine Images, leading to a high possibility that many existing EC2 instances are running the SSM agent.