What is a Command & Control (C2) attack?

How does a C2 attack work?

A C2 attack unfolds sequentially. Each stage builds on the previous one, and the C2 channel is the connective tissue that lets a remote operator orchestrate the entire operation.

1. Initial compromise and foothold

The adversary first infects a target device. Common entry methods include phishing emails with malicious links or attachments, drive-by downloads, exploitation of unpatched vulnerabilities, malvertising, and stolen credentials. A successful infection plants malware that initiates outbound communication.

2. Establishing the C2 connection

Once the malware runs, it "phones home," reaching out to the C2 server to signal it is ready to receive commands. This callback, often called beaconing, is typically disguised inside routine traffic such as HTTP/HTTPS or DNS so it blends with normal network activity. The backdoor channel is now open.

3. Lateral movement and persistence

With a channel established, the attacker harvests credentials, escalates privileges, and compromises additional systems to maintain a durable presence. The goal is to expand control while remaining undetected, sometimes over weeks or months.

4. Data discovery and exfiltration

The operator identifies high-value systems and data, then chunks, compresses, and encrypts it before transmitting it out through the C2 channel. In double-extortion ransomware operations, this stolen data becomes leverage.

5. Actions on objectives and defense evasion

Finally, the attacker executes the end goal: deploying ransomware, conducting espionage, disrupting operations, or launching distributed denial-of-service (DDoS) attacks from a botnet. Throughout, they mimic expected traffic and vary stealth levels to avoid security tooling.

C2 in the Cyber Kill Chain and MITRE ATT&CK

In the Lockheed Martin Cyber Kill Chain, command and control is the fifth stage, appearing just before "actions on objectives." Its position matters: an active C2 channel means the intruder has already defeated earlier controls and gained a foothold. The MITRE ATT&CK framework formalizes this into the Command and Control tactic (TA0011), cataloging 16+ techniques and numerous sub-techniques adversaries use to communicate covertly, including:

• Application Layer Protocol (web protocols, DNS)
• Encrypted Channel and Data Obfuscation
• Dynamic Resolution (domain generation algorithms, fast-flux)
• Protocol Tunneling and Non-Standard Ports
• Ingress Tool Transfer, Multi-Stage Channels, Proxy, and Web Service

Types of C2 architectures

Attackers select an architecture based on how much resilience and stealth they need versus how easily they can control the compromised fleet.

Centralized architecture

The most common model, resembling a traditional client-server setup. Infected devices connect back to one C2 server for instructions. It is the easiest to operate but also the easiest to detect and block, since traffic originates from a single source. Attackers counter this using load balancers, redirectors, proxies, and legitimate cloud or hosting services to disguise the origin.

Peer-to-peer (P2P) architecture

A decentralized model where botnet nodes relay commands to one another rather than depending on a central server. Far harder to detect and dismantle, taking down one node rarely disrupts the whole network. Coordination is harder for the attacker too. P2P is often paired with a centralized model as a resilient fallback.

Random / decentralized architecture

The hardest to detect by design. Commands arrive from disparate, trusted sources such as content delivery networks (CDNs), social media, email, or legitimate web services, making it extremely difficult to trace or block the chain of command.

C2 architecture comparison

Common C2 channels and techniques

Attackers favor channels that are ubiquitous, trusted, and rarely blocked. Understanding these is the foundation of detection.

• DNS tunneling: Encoding commands and data inside DNS queries and responses, a heavily abused covert channel because DNS is rarely filtered.
• HTTP/HTTPS: Blending C2 into ordinary web traffic; encryption hides payloads from inspection.
• Legitimate cloud and social services: Using Google Drive, OneDrive, GitHub, or social platforms as dead drops for instructions.
• Domain generation algorithms (DGA) and fast-flux: Continuously rotating domains and IPs to defeat blocklists.
• Offensive security tools: Frameworks such as Cobalt Strike, Sliver, Mythic, Brute Ratel, Empire, and Covenant, widely repurposed by threat actors.

Types of C2 malware

The malware carrying a C2 channel takes many forms, but its purpose is constant: maintain contact with the C2 server and execute attacker commands.

• Remote Access Trojans (RATs): Give full remote control for data theft and surveillance.
• Botnet agents: Enlist devices into coordinated networks for DDoS and mass operations (e.g., Emotet, TrickBot).
• Rootkits and bootkits: Alter system functions to hide activity and ensure long-term access.
• Keyloggers and infostealers: Capture credentials and sensitive data to feed back over C2.

Real-world examples of C2 attacks

C2 is the operational backbone of the most consequential malware families and intrusion campaigns observed in the wild. The following examples illustrate how central the channel is to modern attacks.

Cobalt Strike

Originally a legitimate red-team tool, Cobalt Strike has become one of the most widely abused C2 frameworks. Its "Beacon" payload communicates with operator infrastructure over configurable, malleable profiles that imitate benign web traffic. It remains the single most-detected threat across Sekoia's C2 tracking each year.

Emotet and TrickBot

These modular botnets rely entirely on C2 to receive updates, drop follow-on payloads, and coordinate activity. TrickBot has abused domain generation algorithms, compromised Internet of Things (IoT) devices such as routers, and non-standard ports for obfuscation, using its C2 channels to deploy ransomware like Ryuk or Conti. Infrastructure takedowns made the point clearly: without their C2 servers, the malware could not function.

Log4Shell (Log4j)

The critical Log4j vulnerability disclosed in 2021 and exploited well into 2023 let attackers execute remote code, install backdoors, and open C2 channels at scale. It is a clear example of an initial-access flaw leading directly to persistent C2.

Advanced Persistent Threat (APT) groups and cloud-based C2

APT groups routinely route C2 through legitimate cloud services such as Google Drive and OneDrive, and mask origins with Virtual Private Networks (VPNs) and Tor, making detection substantially harder and reinforcing why intelligence on live infrastructure is essential.

C2 detection vs. C2 prevention

Both are necessary, but they operate at different points in the attack and carry different trade-offs.

Prevention shrinks the number of channels an attacker can open. Detection ensures that the ones that slip through are found quickly, ideally before the actions-on-objectives stage. An intelligence-led SOC strengthens both layers by keeping knowledge of real C2 infrastructure current.

Devices most vulnerable to C2 attacks

Almost any connected device can be drawn into a C2 operation. The first-infected device is often a doorway rather than the final target, because internal defenses tend to be weaker than the perimeter.

• Edge devices such as routers and switches
• IoT devices, which are often unpatched and inherently insecure
• Laptops and desktops
• Smartphones and tablets
• Servers hosting high-value data

What attackers can achieve through C2

An open C2 channel effectively hands the operator remote control. The consequences range from data loss to full network compromise.

• Malware and ransomware delivery: Pushing additional payloads onto compromised hosts.
• Data theft: Copying financial, proprietary, or client data to attacker-controlled servers.
• Network disruption: Forced shutdowns, reboots, and downtime that halt operations.
• DDoS attacks: Using a botnet to flood targets with traffic.
• Cyber espionage: Long-term, stealthy theft of intellectual property or classified information.

Dangers and business impact of C2 attacks

Because C2 attacks are engineered to persist undetected, an unaddressed channel almost inevitably leads to a data breach. The downstream costs include ransom payments, lost revenue from disrupted operations, incident response expenses, legal fees, regulatory fines, and lasting reputational damage. For smaller organizations, a single successful C2-enabled breach can be existential.

The danger is compounded by dwell time. Because operators deliberately keep traffic low-volume and disguised, an intruder can maintain access for weeks or months, quietly mapping the environment and staging data before acting. The longer a channel goes unnoticed, the larger the eventual blast radius. Reducing time-to-detection is one of the most effective investments a security team can make against C2-driven threats.

How to detect and prevent C2 attacks

C2 activity uses "low and slow" methods that individually look too minor to flag, so detection depends on correlating signals across the network and endpoints over time. Practical measures include:

• Inspect and filter all traffic: Scan inbound and outbound flows for unusual encryption, large transfers, and connections to unfamiliar servers.
• Log and analyze DNS queries: DNS tunneling and DGA activity surface as abnormal query patterns.
• Deploy EDR, NDR, and XDR: Endpoint, network, and cross-layer detection catch beaconing, anomalous processes, and lateral movement.
• Hunt for C2 indicators: Known malicious domains and IPs, look-alike domains, suspicious packet headers, and unusual ports and protocols.
• Operationalize threat intelligence: Feed detection with actionable, up-to-date intelligence on active C2 infrastructure.
• Enforce segmentation and least privilege: Limit lateral movement and reduce the blast radius of any single compromise.
• Validate defenses continuously: Emulate C2 techniques to find and close detection gaps before adversaries exploit them.

Expert insight: a CTI-led, European view of C2 infrastructure

Detecting command and control is only as good as your knowledge of the adversary's infrastructure. Sekoia's Threat Detection & Research (TDR) team proactively tracks live C2 infrastructure year-round, analyzing offensive security tool servers, malware C2 servers, phishing clusters, and delivery infrastructure. That tracking has scaled sharply: Sekoia analysts identified more than 85,000 IP addresses used as C2 servers in 2023, a 30%+ increase over 2022, which itself saw roughly 65,000 addresses across 180+ threats. A separate CTI study identified over 38,000 IP addresses used as C2 servers by ransomware groups in 2021, a 75% jump on 2020.

That intelligence feeds directly into the Sekoia SOC platform, whose detection engines combine SIGMA-based behavioral correlation, a CTI engine that flags contact with known malicious infrastructure, and anomaly detection. As a European vendor, Sekoia combines this CTI-led, tracker-driven approach with a data sovereignty posture that addresses requirements global generalists often cannot, converting raw C2 telemetry into Indicators of Compromise (IoCs) as soon as attacker servers are scanned.

Frequently asked questions