A command and control server (C2 or C&C) is infrastructure that attackers use to send instructions to compromised devices and receive stolen data from them.
How C2 works
After infection, malware “calls home” to its C2 server and receives tasks: run commands, download modules, move to other hosts, exfiltrate files. The regular check-ins are called beaconing. To blend in, C2 traffic is usually hidden in common protocols:
- HTTPS requests that look like normal web traffic;
- DNS queries (DNS tunnelling);
- legitimate services such as cloud storage, Telegram, Slack or GitHub;
- peer-to-peer networks between bots.
Attackers rotate domains and IP addresses, use domain generation algorithms and redirectors to hide the real server. Red teams and criminals use the same C2 frameworks – Cobalt Strike, Sliver, Brute Ratel, Mythic – which is why cracked copies of commercial tools appear in many real attacks.
Why C2 matters for security
Without C2 most malware is blind: botnets, backdoors and remote access trojans all depend on it. That also makes C2 a weak point. Addresses of C2 servers are key indicators of compromise, and law enforcement takes down botnets by seizing or sinkholing their C2 domains.
How to detect and block C2
- Restrict outbound traffic: servers should not connect to the internet freely.
- Inspect DNS and proxy logs for regular beaconing, newly registered domains and unusual volumes.
- Use threat intelligence feeds to block known C2 infrastructure.
- Correlate network signals with endpoint telemetry (EDR, SIEM).
