Command and control (C2)
C2 · C&C · CnC · C2 server · C2 infrastructure · beaconing
The infrastructure an attacker uses to steer compromised machines remotely: sending orders, retrieving data, deploying further tools.
In practice
Once installed, malware regularly contacts its command server for instructions. To stay unnoticed, this traffic imitates legitimate activity (HTTPS, DNS, well-known cloud services) and often follows a regular rhythm known as “beaconing”. Cutting the C2 channel takes away the attacker’s hands, which is why C2 addresses and domains are among the most widely shared indicators of compromise.
On 27 January 2021, an operation coordinated by Europol and Eurojust, involving France, Germany, the Netherlands and the United States among others, took control of the Emotet botnet’s infrastructure: several hundred servers worldwide. Cut off from their C2, infected machines could no longer be steered by the criminals.
How to protect yourself
- Filter outbound traffic and DNS resolution, blocking known malicious domains and addresses.
- Feed threat intelligence (C2 addresses and domains) into the firewall, proxy or SIEM.
- Spot regular, abnormal outbound connections with an EDR, a network sensor or the SIEM.
- Immediately isolate from the network, without switching it off, any machine talking to a known C2.
