Set of servers, protocols and communication channels that an attacker uses to remotely control their implants or botnets after compromising target systems.
The term command and control is borrowed from military vocabulary, where it denotes the operational command chain, and was adopted by information security to describe the infrastructure that allows an attacker to maintain dialogue with their malware deployed on compromised machines. The evolution of C2 architectures illustrates the permanent race between attackers and defenders. The first generations used dedicated IRC or HTTP servers, easily identified and neutralized by domain blocking. Attackers responded with domain generation algorithms to make their infrastructure mobile, then with fast flux, where the IP addresses associated with a C2 domain change every few minutes to circumvent blacklists. Recent generations hijack legitimate services such as GitHub, Twitter, Slack or Google Docs as C2 channels, making traffic indistinguishable from normal enterprise traffic by simple inspection. Certain APT groups use DNS-over-HTTPS or network steganography techniques to conceal their communications within apparently benign protocols. For a SOC analyst, identifying and severing the C2 channel is the most urgent action during an active incident, since without this channel the attacker loses visibility and control over their implants. For the insurer, documented C2 traffic undetected for several weeks constitutes evidence of prolonged dwell time that directly inflates the loss estimate.
During the SolarWinds attack in 2020, the Cozy Bear group used avassvendors.com subdomains and apparently normal DNS queries to quietly exfiltrate data over months. The DNS-based C2 technique prevented detection by the majority of network probes, since corporate DNS traffic is rarely subjected to deep inspection.
C2, C&C, command and control, commande et contrôle, serveur C2, canal de commandement