Command and Control (C2)

Command and control (C2) is the communication channel between compromised systems and the attacker's infrastructure. Malware on a victim's machine is only the hands; C2 is the nervous system that tells those hands what to do — run this command, grab those files, download the next payload, wait. The same channel carries results back out, which makes C2 both the attacker's steering wheel and, frequently, their exfiltration route. A remote access trojan checking in for instructions and a botnet of thousands of machines awaiting orders are both, at bottom, C2 architectures at different scales.

How it works

After the initial compromise — typically a phishing click, a malicious download, or a paste-and-run lure — the implant "beacons" out to attacker-controlled infrastructure: a server, a rented cloud instance, a hijacked website, sometimes even a legitimate service such as a messaging platform or file-sharing API abused as a relay. Outbound connections are used precisely because firewalls scrutinize inbound traffic far more than outbound, and the beacons are disguised as ordinary web traffic — HTTPS requests at randomized intervals, DNS queries carrying encoded data. Through this channel the attacker escalates from one infected machine to an interactive operation: issuing commands, deploying additional tools, and directing lateral movement toward the real objective. Cutting the C2 link effectively blinds the intrusion, which is why takedowns of major malware operations — such as the seizure of some 2,300 domains in the 2025 Lumma Stealer action — focus on the infrastructure rather than the individual infections.

How to defend against it

Prevent the beacon, then hunt it. Egress filtering and DNS security block or log connections to newly registered and known-bad domains; TLS inspection or network analytics catch the telltale rhythm of beaconing that hides inside encrypted traffic; endpoint detection flags the processes making the calls. Because the implant almost always arrives through a human action, the earliest defense is the person: an employee who recognizes the lure and reports it immediately can end the intrusion before the first beacon fires — and awareness of paste-and-run tricks like ClickFix, which hand the attacker their first C2 connection with the victim's own keystrokes, closes off one of the fastest-growing delivery paths.