Command and control infrastructure (C2/C&C)

In the SolarWinds attack, disclosed in December 2020, the SUNBURST backdoor hidden in Orion updates sat dormant for up to two weeks, then queried generated subdomains of avsvmcloud[.]com. The DNS answer decided what came next: for most of the roughly 18,000 customers that had installed the update, nothing; for about a hundred companies and nine US federal agencies, a second channel opened. The C2 doubled as a victim filter. Command and control infrastructure (C2, or C&C) is the set of servers, protocols and channels an attacker uses to run implants after the compromise: sending orders, collecting results, exfiltrating data. The term comes from military usage. Early generations relied on fixed IRC or HTTP servers that were easy to block. Then came domain generation algorithms (DGAs), fast flux, where a domain's IP address keeps rotating, and later the abuse of legitimate services (GitHub, Slack, Google Docs, cloud storage) whose traffic blends in with normal corporate use. Some groups tunnel over DNS-over-HTTPS to dodge inspection. MITRE ATT&CK treats it as a tactic of its own, TA0011. Cutting the C2 channel is the first move in incident response: without it, the attacker goes blind on the implants. For the claims adjuster, C2 traffic logs date the compromise, and a channel left open for weeks undetected stretches dwell time, which pushes the loss estimate up.