C2 (Command and Control)
A Command and Control server is infrastructure used by attackers to remotely control compromised hosts (a botnet) and deliver instructions, exfiltrate data, or push malware updates. Blocking C2 communications is one of the most effective ways to disrupt an active attack.
A C2 server is the machine an infected host talks to. After the initial compromise the malware needs instructions, a place to send what it steals and a way to receive updates; the C2 server provides all three. Traffic to it is called beaconing: short, regular check-ins that ask “anything for me?” and blend into ordinary web traffic.
Everything the attacker does after the foothold passes through this channel, which makes it the single best place to intervene. Cut the C2 and the implant is inert: it cannot receive commands, exfiltrate or spread. This is why C2 indicators are treated as the highest-value entries in a blocklist.
Modern C2 hides in plain sight. It uses HTTPS on port 443, domain fronting through CDNs, legitimate cloud services as dead drops, and rotates domains generated by an algorithm. Detection therefore leans on intelligence (known servers, known frameworks, known certificate patterns) as much as on traffic analysis.
Example
A firewall log shows a workstation connecting to the same address every 47 seconds, 2 KB each way, for six hours. The address is listed by a tracker as a Sliver C2 server first seen four days ago. The pattern was the tell; the listing was the confirmation.
In isMalicious
Look up the address or domain and the report says whether a C2 tracker lists it, for which framework, and when it was last seen live. The same indicators are exported in the C2 feed at /data/c2-feeds for firewall and DNS-layer blocking.
Frequently Asked Questions
What is C2 (Command and Control)?
A Command and Control server is infrastructure used by attackers to remotely control compromised hosts (a botnet) and deliver instructions, exfiltrate data, or push malware updates. Blocking C2 communications is one of the most effective ways to disrupt an active attack.
How is C2 (Command and Control) related to Botnet?
C2 (Command and Control) and Botnet are both key concepts in threat intelligence. A botnet is a network of compromised devices ("bots") controlled by an attacker via a C2 server. Botnets are used for DDoS attacks, spam campaigns, credential stuffing, and ransomware delivery. Individual bots are often unaware they are compromised.
Related Terms
Botnet
A botnet is a network of compromised devices ("bots") controlled by an attacker via a C2 server. Botnets are used for DDoS attacks, spam campaigns, credential stuffing, and ransomware delivery. Individual bots are often unaware they are compromised.
IOC (Indicator of Compromise)
An indicator of compromise is an indicator supported by evidence of compromise or malicious activity. Security teams use IOCs to detect, contain, and investigate threats; an arbitrary IP address, domain, URL, file hash, or email address is only an observable until evidence supports that promotion.
Ransomware
Ransomware is malware that encrypts a victim's files or systems and demands payment (usually cryptocurrency) for the decryption key. Modern ransomware groups also exfiltrate data before encrypting and threaten to publish it — a tactic called double extortion.
Put this intelligence to work
Query indexed indicators — IPs, domains, URLs, and hashes — in seconds.