Command and Control (C2).

Command and control (C2 or C&C) refers to the servers, protocols, and traffic patterns that let an attacker manage implanted malware after initial compromise. C2 channels deliver commands, retrieve stolen data, push new payloads, and coordinate multi-host operations. Operators use HTTP(S), DNS tunnelling, messaging apps, social-media accounts, cloud APIs and even legitimate SaaS platforms to blend in. To stay resilient they employ domain generation algorithms (DGAs), fast-flux DNS, redirectors and encrypted protocols. It is a distinct tactic in MITRE ATT&CK (TA0011).

Beaconing and channel selection

flowchart TD
  A[Compromised host / implant] -->|periodic beacon| B[Redirector / CDN front]
  B --> C[C2 server]
  C -->|tasking| A
  A -->|exfil over same channel| C
  A -.->|primary blocked| D[Fallback channel: DNS / SaaS]
  D --> C

How real operations hide their traffic

The two examples above bracket the design space. Cobalt Strike, a commercial red-team tool heavily abused by ransomware crews, runs a "Beacon" implant whose malleable C2 profiles let operators shape HTTP(S) requests to imitate legitimate services, sleep between check-ins to evade beaconing analytics, and pivot over SMB named pipes for peer-to-peer control inside a network. At the stealthy end, the 2020 SUNBURST backdoor planted in SolarWinds Orion used a DNS-based coordination channel: infected hosts encoded the victim's internal Active Directory domain into subdomain labels of avsvmcloud[.]com, and DNS responses signalled whether to stay dormant or escalate to an HTTP C2 for hands-on tasking — a design that let it hide among Orion's normal telemetry for months.

Detection focuses on the pattern rather than any single domain: regular beacon intervals with jitter, unusual JA3/JA4 TLS fingerprints, high-entropy or long DNS queries, and connections to newly registered or low-reputation infrastructure. Defences include egress filtering and DNS analytics, TLS inspection where lawful, network detection and response (NDR), blocking DNS over HTTPS to untrusted resolvers, and disrupting infrastructure through coordinated takedowns and sinkholing.