A command-and-control server is a device or machine under the control of a cybercriminal. It’s also commonly referred to as a C&C or C2 server. An attacker uses this server to maintain communications with and remotely control malware or malicious scripts within a target network.
A command-and-control server can also receive stolen data from compromised systems, including computers, mobile phones, and even Internet of Things (IoT) devices connected to an infected network. Some cyber attackers hide command-and-control servers in file-sharing services to evade detection and blocking.
A command-and-control server can be likened to the puppeteer who controls the puppets in a show. The puppets’ actions depend on the instructions issued by the command-and-control server.
Other interesting terms…
Read More about a Command-and-Control Server
We dive deeper into command-and-control servers below, tackling how they work, how they are used, and how to block them.
What Purpose Do C2 Servers Have?
The primary goal of a C2 server is to bridge the gap between an operator and a fleet of remote machines. This setup provides three main benefits:
- Centralized control: Instead of logging into 1,000 computers individually, an operator sends one command to the C2 server. The server then pushes that command to every connected device.
- Coordination: The server can make multiple devices work together. For example, it can tell them all to download a specific file at the exact same time.
- Persistence: If a remote computer restarts or changes its IP address, it is programmed to beacon, or call home, to the C2 server. This ensures the operator does not lose access to the machine.
Are All Command-and-Control Servers Malicious?
Not all C2 servers are malicious. While the term is often associated with cyberattacks, it actually describes a method that modern networks use to function. At its core, a C2 server is just a central computer that sends instructions to other devices.
Here’s a TL;DR version of the legitimate and malicious use cases of C2 servers.
Legitimate Use of C2 Architecture
In a professional setting, administrators use C2-style architectures to manage thousands of machines at once.
Without this centralized control, IT departments would have to manually update every individual laptop or server. For example, tools such as Windows Server Update Services (WSUS) act as C2 hubs. They tell every computer on a corporate network when to download and install security patches.
Platforms like Kubernetes use a control plane to manage clusters of servers, serving as a central hub that instructs individual nodes when to start or stop applications based on web traffic.
C2-style architecture also helps with remote management. Systems like Jamf or Microsoft Intune, for instance, allow companies to manage employee phones and laptops. If an employee loses a phone, the admin sends a command from the server to remotely wipe the device’s data.
Malicious Usage of C2 Servers
When a threat actor uses a C2 server, they do so without the owner’s permission. In this context, the server becomes a tool for digital crime. A command-and-control server can help hackers:
- Steal confidential data: One of the primary goals of using a command-and-control server is to steal highly confidential data, such as financial credentials. The server acts as storage for stolen files and logs that are later sent to a remote site still under the attackers’ control.
- Shut a network down: Attackers can also incapacitate a target organization with the help of command-and-control servers. They do so by shutting down machines, halting the company’s entire operations.
- Reboot systems: Hackers can also choose to reboot malware-infected systems repeatedly, which can disrupt an enterprise’s operations via a command-and-control server.
- Launch a distributed denial-of-service attack: All distributed denial-of-service (DDoS) attacks use a command-and-control server. The server issues a command to all machines under its control to flood a target network with Internet traffic, overwhelming a website and rendering it inaccessible.
How C2 Communication Works
A command-and-control server acts as a remote manager for infected devices. This communication is rarely a constant connection. Instead, it follows a specific flow to avoid triggering security alerts.
The process starts after a device (aka host) is infected with malware. The malware uses a domain name to find and contact the C2 server to announce that the device is online, an event often called “calling home.” Once the server acknowledges the device, the attacker can send instructions back and forth.
How C2 Servers Communicate with Infected Hosts
Attackers use different methods to stay in touch with their bots:
- Beaconing: This is the most common method, and it involves the infected host sending a signal, or “beacon,” to the server at regular intervals. It is like a heartbeat that tells the attacker the device is still ready to take commands.
- Polling: In this model, the infected device “polls” the server to see if there are any pending commands. If the server is silent, the device goes back to sleep to save resources and stay hidden.
- Push: This is a direct connection where the server sends commands to the host immediately. This is less common because modern firewalls block unsolicited incoming traffic.
Common Communication Protocols and Channels
Throughout communication between the host and the server, attackers hide their traffic within everyday internet protocols to make it appear to be normal web browsing.
Most C2 traffic uses the HTTP/HTTPS protocols because they are allowed through almost every firewall. To a security tool, it looks like a user is just visiting a website. However, some malicious actors send data inside DNS queries. While this is a slower method, attackers use it because many organizations do not monitor DNS traffic as strictly as web traffic.
Some advanced attackers use sites like GitHub, Twitter, or Discord to host commands. Since these are legitimate sites, security software rarely blocks the connection.
What Attackers Use C2 Servers For
Once a connection is established, the attacker has a wide range of options. The C2 server allows them to treat the victim’s computer like their own.
| What Attackers Can Do Through C2 Servers | How It Works |
| Command Execution | Attackers can run terminal commands or scripts to change settings, delete files, or create new user accounts. |
| Data Exfiltration | The C2 server can instruct the infected host to find sensitive files and upload them to the attacker’s server. |
| Payload Delivery | If the initial malware is just a loader, the server will send a second, more dangerous piece of software, such as ransomware, through the C2 server. |
| Botnet Coordination | For DDoS attacks, the server coordinates thousands of devices to hit a single target at the exact same time. |
Why C2 Servers Matter in Security
The C2 server provides the flexibility attackers need. If a company finds and deletes a specific piece of malware, the attacker can use the C2 server to push a different version of the malware to other devices on the same network. This makes the infection much harder to clear.
Because the C2 server is so important for attackers, it is also a primary target for defenders. If a company blocks the C2 address, the malware on its network becomes useless. Even better, if the C2 server goes offline, the entire botnet loses its ability to function, forcing the threat actor to set up a new attack infrastructure.
Therefore, security researchers work hard to identify C2 domains and IP addresses and share them globally through threat reports and threat intelligence feeds, such as ThreatFox or commercial feeds. The Cybersecurity and Infrastructure Security Agency (CISA), for one, regularly publishes cybersecurity advisories, such as this one that lists more than 100 Lumma C2 domains.
In some cases, law enforcement agencies conduct a takedown where they seize the physical servers or take over the digital domains used by the attackers. For example, the FBI and Europol seized 2,300 domains that served as Lumma C2 servers back in May 2025.
How to Block Command-and-Control Server Connections
Command-and-control servers continuously evolve to evade detection. As such, no single way can detect them. A combination of the following strategies can, however, prove useful.
Monitor Dubious Network Activities
IT security teams should look into suspicious connection attempts, particularly outbound ones. Regularly updating service blacklists can help manage doubtful communications. For example, hundreds to thousands of users suddenly opening a blog post at the same time can be indicative of botnet activity.
Enhance Firewall and Intrusion Prevention and Detection Systems
Employing stricter network access and limiting the number of open ports can help prevent a takeover. For instance, users should only permit internal access to a Domain Name System (DNS) server. Any other attempts to connect to it can be considered red flags.
Run System Integrity Checks
To detect command-and-control server connections, teams should go beyond merely updating antivirus solutions. Administrators should run system integrity checks regularly and limit access privileges.
Key Takeaways
- A C2 server acts as a central hub that allows operators to manage and coordinate a fleet of remote devices.
- While IT professionals use this architecture for legitimate tasks like software updates and remote support, threat actors use it to manage malicious botnets and launch attacks.
- The communication process begins when an infected host uses a domain name to call home and announce its presence to the attacker.
- Attackers hide this traffic within common protocols like HTTP/HTTPS to mimic standard web browsing or within DNS to bypass firewalls.
- Once a connection is established, the server can instruct the host to steal sensitive data, deliver additional malware, or launch DDoS attacks.
- Security teams focus on disrupting these servers because taking down the C2 server renders the entire network of infected bots useless.
