.png)
What is Command and Control (C2)?
Command and control is the communication channel attackers use to control compromised systems. Learn how C2 works, how attackers evade detection, and what disrupts C2 communications.
C2 Communication Techniques
Modern C2 frameworks go to significant lengths to blend their communications with legitimate traffic. HTTPS beaconing uses encrypted web traffic to communicate with attacker servers over port 443, indistinguishable from normal web browsing without SSL inspection. DNS beaconing encodes C2 communications in DNS queries, exploiting the fact that DNS is almost universally allowed through firewalls and often inspected at low fidelity. Domain fronting routes C2 traffic through trusted CDN infrastructure — Cloudflare, Fastly, Amazon CloudFront — making C2 communications appear to originate from legitimate cloud services.
Beacon intervals are designed to evade detection by traffic analysis. A C2 implant that checks in every 60 seconds with a consistent pattern is detectable through anomaly detection. Modern C2 frameworks use jittered beacon intervals — randomizing the check-in time within a range — to eliminate the periodic pattern that network monitoring tools identify as beaconing.
C2 Frameworks Used by Attackers
Cobalt Strike is the most widely used C2 framework in enterprise attacks, used by both criminal ransomware groups and nation-state actors. Its Beacon payload provides a full-featured post-exploitation platform including C2 communication, lateral movement, privilege escalation, and credential theft capabilities. Metasploit's Meterpreter, Sliver, Brute Ratel, and Empire are other commonly observed frameworks. Detection of C2 framework traffic patterns is a primary focus of EDR and network security tools, and attackers continuously modify their tooling to evade detection signatures.
Detecting and Disrupting C2
C2 detection requires multiple complementary approaches. DNS monitoring identifies suspicious domain resolution patterns — newly registered domains, domains with high entropy names characteristic of DGA (Domain Generation Algorithm) malware, DNS query volumes inconsistent with legitimate usage. Network behavior analysis identifies beaconing patterns in outbound traffic — regular intervals of communication to the same external destination. Threat intelligence feeds blacklist known C2 infrastructure, blocking communications to identified attacker domains and IPs. EDR behavioral detection identifies process behaviors associated with C2 activity regardless of the specific domain or IP used.
Proactive C2 disruption — identifying and sinkholing or blocking C2 infrastructure — is a government and private sector threat intelligence operation that specifically targets ransomware and nation-state C2 networks. FBI and CISA operations have disrupted multiple ransomware C2 networks, including operations against Hive and ALPHV infrastructure.
Real-World Example: FBI Disrupts Hive Ransomware C2
In January 2023, the FBI announced it had secretly infiltrated the Hive ransomware group's C2 infrastructure for seven months, obtaining decryption keys that allowed 300 current victims to decrypt their data without paying ransom and prevented an estimated $130 million in additional ransom payments. The operation demonstrated the strategic value of C2 infrastructure disruption: by penetrating C2 networks rather than simply blocking them, law enforcement could provide active assistance to victims while gathering intelligence on the criminal operation. Hive subsequently ceased operations.
Of advanced malware uses encrypted HTTPS for command and control communications — making C2 traffic indistinguishable from legitimate web browsing without SSL inspection, which most organizations have not deployed.