Command-and-Control

What it is

Command-and-control, often abbreviated C2, is communication between compromised systems and infrastructure used by an attacker. It carries instructions, status, or stolen information. C2 is not limited to obviously suspicious protocols: ordinary web traffic, DNS, or legitimate external services can be misused as carriers.

How it works

A compromised process initiates or maintains a channel and receives tasks or sends results. Some channels communicate periodically and others blend with normal application activity. Encryption may hide content from network inspection, so defenders also examine the originating process, destination, timing, and expected business use.

How people get tricked

A familiar protocol or cloud service is assumed safe. Operators may see only successful web requests and overlook the compromised process making them. Not every periodic connection is malicious; context and corroborating evidence matter.

Example scenario

An unauthorized process contacts an external service at regular intervals to receive instructions. Blocking that destination interrupts one channel but does not remove the process or its persistence.

Warning signs

• Unexpected outbound destinations or recurring connections from unusual processes.
• DNS or web activity inconsistent with the device's intended role.
• Endpoint findings correlate with suspicious network communication.

If it happens to you

Isolate compromised systems and preserve process and network evidence. Investigate related hosts, stolen credentials, and data transfers. Remove the infection and access path; blocking one address can be temporary because the operator may switch infrastructure.