CyberGlossary

Malware

Command and Control (C2)

Also known as: C2, C&C, Command-and-control server

Definition

The infrastructure and channels attackers use to maintain communication with compromised systems and send them instructions.

Command and control (C2 or C&C) refers to the servers, protocols, and traffic patterns that let an attacker manage implanted malware after initial compromise. C2 channels deliver commands, retrieve stolen data, push new payloads, and coordinate multi-host operations. Operators use HTTP(S), DNS tunnelling, messaging apps, social-media accounts, cloud APIs and even legitimate SaaS platforms to blend in. To stay resilient they employ domain generation algorithms (DGAs), fast-flux DNS, redirectors and encrypted protocols. Defences include egress filtering, DNS analytics, TLS inspection where lawful, network detection and response (NDR), and disrupting C2 via takedowns or sinkholing.

Examples

  • Cobalt Strike Beacon's HTTPS, DNS, and SMB-pipe C2 channels.
  • DGAs used by Conficker to generate hundreds of pseudo-random C2 domains daily.

Related terms