command-and-control

Definition

A **C2** (short for **Command and Control**) is the system attackers use to **remotely communicate with and control compromised machines** after they’ve gained access.

Think of it as the attacker’s “mission control center.” Once malware is installed on a victim system, it will often “phone home” to a C2 server to:

* Receive commands (e.g., “steal this file,” “move to another system,” “encrypt all documents”)
* Download additional malicious payloads
* Upload stolen data
* Send back status updates about the infected host

C2 infrastructure can take many forms:

* **Dedicated servers** – Often hidden behind VPNs, proxies, or Tor
* **Compromised websites** – Legitimate sites hijacked to act as relay points
* **Cloud services & social media** – Using Dropbox, Google Drive, Twitter, or Slack to blend in with normal traffic
* **Domain Generation Algorithms (DGAs)** – Malware dynamically creates domain names to reach the C2, making blocking harder

Why it matters in investigations:

* C2 traffic is a major detection opportunity — spotting unusual outbound connections can reveal an active intrusion.
* Identifying the C2 can help **attribute the attack** (many threat groups reuse infrastructure).
* Shutting down or blocking the C2 can break the attacker’s control over compromised systems.

command-and-control

Definition

Explore More Terms

Examples & Use Cases