What is Command and Control?

Once malware establishes persistence it needs a way to receive instructions and send back results, and that channel has to survive network security controls without standing out. Early C2 relied on raw TCP or IRC, both trivial to block with a firewall rule. Modern frameworks, Cobalt Strike, Mythic, Sliver, Brute Ratel, default to HTTPS traffic shaped to mimic legitimate browsing, complete with realistic user-agent strings and jitter between beacons so the timing doesn't look mechanical.

Domain fronting routes C2 traffic through a CDN, presenting one hostname in the TLS SNI field while the actual HTTP Host header points to the real C2 server, so the traffic appears to go to a trusted service. DNS-based C2 tunnels commands and data inside DNS queries and TXT record responses, which is hard to block outright because every network depends on DNS functioning. Domain Generation Algorithms (DGAs) compute a new C2 domain daily or hourly from a shared seed, so blocklisting yesterday's domain doesn't stop tomorrow's traffic.

Detection focuses on behavior rather than signatures: beacon regularity (a host checking out at suspiciously consistent intervals even with added jitter), connections to domains registered days ago, unusually high ratios of encrypted traffic to a single external host, DNS query volumes and entropy patterns consistent with DGA output, and TLS certificates that are self-signed or freshly issued. JA3/JA3S TLS fingerprinting can also flag known C2 framework traffic even when the destination domain itself is unfamiliar.

C2 architecture varies by resilience needs. Single-server C2 is simple but a single point of failure once discovered. Redirector chains put disposable front-end servers (often on legitimate cloud providers) between the compromised host and the actual team server, so taking down the visible endpoint doesn't expose the real infrastructure. Peer-to-peer C2 lets compromised hosts relay commands to each other, so only one machine on the network needs external connectivity, which defeats detection strategies that only watch the network perimeter. Dead-drop resolvers stage the real C2 address on a legitimate site, a paste site, a social media profile, a cloud storage link, and the malware only needs to fetch that one page to find where to check in next.