Command and Control (C2) Servers: How Attackers Run Malware

In August 2023, the FBI announced Operation Duck Hunt, which took over the QakBot botnet’s servers and cut off infected computers worldwide. Those servers were command and control infrastructure: the hidden systems attackers use to send orders to malware. Take them away, and the malware has no instructions to follow.

What Is Command and Control in Cyber Security?

Command and control (C2, or C&C) is the infrastructure attackers use to communicate with malware on compromised devices. Infected machines connect, or “beacon,” to a C2 server to receive commands, download extra payloads and send stolen data back, letting attackers run the whole attack remotely.

In short, C2 follows three steps:

1. Infect: malware lands on a device.
2. Beacon: the malware calls home to the C2 server.
3. Execute: the attacker sends commands and the malware carries them out.

What Is a C2 Server?

A C2 server is the attacker-controlled machine, or set of machines, that infected devices report to. It might be a rented cloud server, a hacked website, or an account on a legitimate service. Attackers often hide it behind several layers of relays so defenders cannot easily trace or block it.

Command and Control vs Botnet

A botnet is the network of infected devices; C2 is how the attacker controls them. Every botnet needs C2, but C2 is also used in targeted attacks on a single business with only a few infected machines.

How a C2 Attack Works

Stage 1: Initial Infection

The attacker gets malware onto a device, most often through a phishing email, a malicious download, a stolen password or an unpatched internet-facing system.

Stage 2: Beaconing to the C2 Server

The malware contacts its C2 server, usually at set intervals, to say “I’m here” and ask for instructions. These check-ins are designed to look like normal web or DNS traffic.

Stage 3: Receiving Commands and Taking Action

The attacker sends tasks: run a command, download another tool, collect passwords, scan the network, copy files or start encryption. Results flow back through the same channel.

C2 Architecture Models

Centralized (Client-Server) C2

All infected devices report to one server or a small group. It is simple to run but has a single point of failure, which is why law enforcement takedowns target these servers.

Peer-to-Peer (P2P) C2

Infected devices pass commands among themselves, so there is no single server to seize. This makes the network more resilient but slower and harder for attackers to manage.

Cloud, Social Media and SaaS-Based C2

Attackers increasingly hide C2 inside trusted services such as messaging apps, code repositories and cloud storage. Traffic to these services is common in businesses, so blocking it outright is rarely practical.

Common C2 Communication Techniques

MITRE ATT&CK, the widely used catalog of attacker behavior, lists C2 as its own tactic (TA0011), with techniques including:

• HTTP/HTTPS and encrypted traffic: C2 blends into ordinary web browsing, and encryption hides the content.
• DNS tunneling: commands and data are hidden inside DNS queries and responses.
• Domain generation algorithms (DGA): malware generates many new domain names daily, and the attacker registers only a few, making blocklists hard to maintain.
• Fast flux: domains rapidly switch between many IP addresses.
• Domain fronting and legitimate service abuse: traffic appears to go to a trusted provider while really reaching the attacker.

What Attackers Can Do Through C2

Once C2 is in place, attackers can steal data and credentials, move laterally to other systems, install ransomware, add the device to a botnet for spam or DDoS attacks, take screenshots or log keystrokes, and maintain long-term access even after the original entry point is closed.

C2 Malware and Frameworks: Real-World Examples

Malware Families (Emotet, TrickBot, QakBot)

Emotet, TrickBot and QakBot began as banking malware and evolved into delivery services that sold access to other criminals, often ransomware gangs. Europol announced a coordinated disruption of Emotet’s infrastructure in January 2021. The FBI’s 2023 QakBot operation redirected infected computers to FBI-controlled servers that uninstalled the malware.

Red Team Tools Abused by Attackers (Cobalt Strike, Sliver, Brute Ratel)

Cobalt Strike, Sliver and Brute Ratel are frameworks built for authorized penetration testing. Criminals use stolen or cracked copies as ready-made C2 platforms. In 2024, the UK National Crime Agency led an international action with Europol, known as Operation Morpheus, against unlicensed Cobalt Strike servers used by criminals.

How to Detect and Block C2 Traffic

Signs of C2 Activity

• Regular, repeated connections from one device to the same rare external destination
• Unusually long or high-volume DNS queries, or many lookups for random-looking domains
• Connections to newly registered domains or unusual countries
• Traffic at odd hours or from servers that should not browse the web
• Security tools disabled or new scheduled tasks and services on a device

Network Monitoring and NDR

Network detection and response tools look for beaconing patterns, unusual destinations and odd connection fingerprints, even in encrypted traffic.

Endpoint Detection (EDR)

EDR spots the process making the connection, such as a document reader suddenly talking to the internet, and can isolate the device.

DNS Filtering and Threat Intelligence

Protective DNS services block lookups for known malicious and newly registered domains. The UK NCSC runs a Protective DNS service for the public sector, and CISA offers one to US federal agencies.

Prevention Steps

• Restrict outbound (egress) traffic so servers can reach only what they need
• Route web traffic through a filtering proxy or secure web gateway
• Use protective DNS and block newly registered domains
• Keep EDR on every device and alert on tampering
• Patch internet-facing systems and enforce MFA to block initial access
• Keep application allowlists on critical servers

C2 Takedowns and Guidance in the US and UK (FBI, CISA, NCSC)

Law enforcement increasingly targets C2 directly. Beyond Emotet and QakBot, Europol coordinated Operation Endgame in May 2024, which it described as the largest ever operation against botnets, disrupting several malware droppers. CISA and the FBI publish joint advisories with indicators of compromise for active C2 infrastructure, and the NCSC encourages UK organizations to use protective DNS and logging. Cyber Essentials’ firewall control also supports limiting unnecessary connections.

Could You Spot a Command and Control Beacon Today?

Every C2 channel relies on one thing: a device on your network quietly calling out. Here is the challenge: pick one server and list every external destination it contacted last week. If you cannot answer, an attacker’s command and control traffic could be hiding in plain sight. Cyber Security Solutions Ltd can help you review egress controls and monitoring through our contact page.