What Is Command and Control (C2)?
Text
Command and control (C2), also written C&C, is the set of techniques and infrastructure that attackers use to communicate with and remotely direct malware on compromised systems. Once a device is infected, it establishes a connection back to an attacker-controlled server — known as a C2 server, through which the attacker can issue instructions, deploy more malware, and steal data. C2 is what turns isolated malware infections into coordinated, multi-stage cyberattacks.
How does a command and control (C2) attack work?
Text
A C2 attack unfolds in stages after an initial compromise. First, the attacker infects a target device, usually through a phishing email, a malicious download, stolen credentials, or an exploited software vulnerability. The infected device then "phones home," establishing a connection to the attacker's C2 server and signaling that it's ready for instructions, a repeating check-in known as beaconing. Through this channel, the attacker can issue commands to steal data, download additional malware, move laterally to other systems, or maintain long-term access. To stay hidden, attackers often disguise C2 traffic to blend in with legitimate protocols like HTTPS and DNS.
What is a C2 server?
Text
A C2 server (command and control server) is the attacker-controlled system that acts as the central hub for a command and control attack. It's the infrastructure a compromised device connects back to in order to receive instructions and send stolen data, essentially the attacker's remote control over the victim's network. Attackers use C2 servers to coordinate their operations: pushing new commands, delivering additional payloads, and collecting exfiltrated data. A single C2 server can also serve as the headquarters for a botnet, a network of infected devices used for large-scale attacks like DDoS. To avoid takedown, attackers often hide C2 servers behind proxies, encryption, or legitimate cloud services.
How do you detect command and control (C2) traffic?
Text
Detecting C2 traffic relies on spotting abnormal behavior over time rather than just blocking known malicious IPs, since modern C2 channels are designed to blend into normal business traffic. The most reliable signal is beaconing, small, repetitive outbound connections sent at regular intervals. Security teams also watch for unusual DNS queries (such as long or encoded subdomains), connections to newly registered or suspicious domains, traffic on non-standard ports, and anomalies in encrypted HTTPS sessions. An effective approach combines network traffic analysis, DNS monitoring, endpoint detection (EDR), behavioral analytics, and threat intelligence to catch C2 activity before data is exfiltrated.