What Is C2? Command And Control Infrastructure Explained - Varonis

Platform The #1 Data Security Platform Varonis is your all-in-one SaaS platform to automatically find critical data, remediate exposure, and stop threats in the cloud and on-premises. Platform overview WHERE TO BUY

CAPABILITIES

Data discovery & classification

Accurately discovery, classify, and label sensitive data.

DSPM

Improve your data security posture automatically.

Data-centric UEBA

Detect, investigate, and respond to attacks on data.

Data access governance

See exactly who can touch sensitive data at all times.

DLP

Monitor data activity and prevent exfiltration.

SERVICES

MDDR

24x7x365 data detection & response with an SLA.

Platform Cloud-native architecture Athena AI Coverage WHERE TO BUY

A leader in data security

“Varonis is a top choice for organizations prioritizing deep data visibility, classification capabilities, and automated remediation for data access.”

Industry recognition

Learn more

Cloud-native architecture Athena AI Coverage Solutions

Insider risk management

Identify and prevent insider risks.

Ransomware prevention

Detect and prevent ransomware attacks.

Compliance management

Automate compliance regulations and frameworks.

Email security

Lock down sensitive mailboxes and stop exfiltration.

Identity protection

Detect attacks on AD, Entra ID, and Okta.

AI security

Secure AI copilots and LLMs.

Data risk assessment

Map data risk and build a path to remediation.

Cloud data security

Label critical data, monitor flows, and enforce policy.

Coverage

Protection Packages

Microsoft 365 & Entra ID

Advanced data protection for your Microsoft cloud.

Windows & NAS

Protect cloud, hybrid, and on-premises files shares.

SaaS apps

Protect mission-critical data in SaaS apps.

Cloud infrastructure

Protect data in AWS, Azure, and Google Cloud.

Databases

Discover, classify, and protect any database.

Integrations

Microsoft 365

Microsoft Copilot

Windows File Shares

Active Directory

Google Workspace

Google Cloud

Salesforce

Box

AWS

Azure

Databricks

ServiceNow

See all integrations Company

About Varonis

Who we are

Careers

Investor relations

Trust & Security

Public sector

Newsroom

Contact us

Brand

Partners

Partner program

Partner locator

Partner portal

Buy on AWS marketplace

Buy on Azure marketplace

Resources

Blog

Learn from cybersecurity experts.

Support

Get technical support.

State of Cybercrime

Video podcast covering the latest cyber news.

Speed Data

Quick conversations with security leaders.

Webinars

Educational CPE webinars.

Events

Meet the Varonis team in person.

Community

Product documentation, Q&A forums, knowledgebase, and more.

Learn more

Product training

On-demand training and how-to videos for the Varonis DSP.

Learn more

Varonis Threat Labs

Read all the latest research

Ghost Sites: Stealing Data From Deactivated Salesforce Communities

Defending Your Cloud Environment Against LAPSUS$ Style Threats

Abusing Misconfigured Salesforce Communities for Recon and Data Theft

Languages

• English
• Français

• English
• Français

Get a demo Get a demo Blog Data Security What is C2? Command and Control Infrastructure Explained A successful cyberattack is about more than just getting your foot into the door of an unsuspecting organization. To be of any real benefit, the attacker needs to maintain persistence… Robert Grimmick 7 min read Last updated August 8, 2022

Contents

A successful cyberattack is about more than just getting your foot into the door of an unsuspecting organization. To be of any real benefit, the attacker needs to maintain persistence within the target environment, communicate with infected or compromised devices inside the network, and potentially exfiltrate sensitive data. The key to accomplishing all these tasks is a robust Command and Control Infrastructure or “C2”. What is C2? In this post, we’ll answer that question and look at how adversaries use these covert channels of communication channels to carry out highly sophisticated attacks. We’ll also look at how to spot and defend against C2-based attacks.

What is C2?

Command and Control Infrastructure, also known as C2 or C&C, is the set of tools and techniques that attackers use to maintain communication with compromised devices following initial exploitation. The specific mechanisms vary greatly between attacks, but C2 generally consists of one or more covert communication channels between devices in a victim organization and a platform that the attacker controls. These communication channels are used to issue instructions to the compromised devices, download additional malicious payloads, and pipe stolen data back to the adversary.

C2 comes in many different forms. At the time of writing, the MITRE ATT&CK framework lists 16 different command and control techniques, each with a number of sub-techniques that have been observed in past cyberattacks. A common strategy is to blend in with other types of legitimate traffic that may be in use at the target organization, such as HTTP/HTTPS or DNS. Attackers may take other actions to disguise their C&C callbacks, such as using encryption or unusual types of data encoding.

Download the full Netcat cheatsheet

Command and control platforms may be fully customized solutions or off-the-shelf products. Popular platforms used by criminals and penetration testers alike include Cobalt Strike, Covenant, Powershell Empire, and Armitage.

There are a number of terms you may also hear alongside C2 or C&C:

What is a Zombie?

A Zombie is a computer or other type of connected device that’s been infected with some form of malware and can be remotely controlled by a malicious party without the real owner’s knowledge or consent. While some viruses, trojans, and other unwanted programs perform specific actions after infecting a device, many types of malware exist primarily to open up a pathway to the attacker’s C2 infrastructure. These “zombie” machines can then be hijacked to perform any number of tasks, from relaying spam e-mail to taking part in large-scale Distributed Denial of Service Attacks (DDoS).

What is a Botnet?

A botnet is a collection of zombie machines that are enlisted for a common illicit purpose. This could be anything from mining cryptocurrency to knocking a website offline through a Distributed Denial of Service (DDoS) attack. Botnets are usually united around a common C2 infrastructure. It’s also common for hackers to sell access to botnets to other criminals in a type of “attack as a service”.

What is Beaconing?

Beaconing refers to the process of an infected device phoning home to an attacker’s C2 infrastructure to check for instructions or additional payloads, often at regular intervals. To avoid detection, some types of malware beacon at random intervals, or may lie dormant for a period of time before phoning home.

What Can Hackers Accomplish with a Command and Control Infrastructure?

Most organizations have fairly effective perimeter defenses that make it difficult for an adversary to initiate a connection from the outside world into the organization’s network without being detected. However, outbound communication is often not as heavily monitored or restricted. This means that malware introduced through a different channel – say a phishing email or compromised website – can often establish a channel of communication in the outbound direction that would otherwise be impossible. With this channel open, a hacker can carry out additional actions, such as:

Move Laterally Through a Victim’s Organization

Once an attacker has an initial foothold, they will usually seek to move laterally throughout the organization, using their C2 channels to beam back information about other hosts that may be vulnerable or misconfigured. The first machine compromised may not be a valuable target, but it serves as a launching pad to access more sensitive parts of the network. This process may be repeated several times until the attacker gains access to a high-value target like a file server or domain controller.

Multi-stage Attacks

The most complex cyberattacks are often composed of many distinct steps. Often, the initial infection consists of a “dropper” or downloader that calls back to the adversary’s C2 infrastructure and downloads additional malicious payloads. This modular architecture allows an attacker to carry out campaigns that are both widely distributed and highly focused. The dropper may infect thousands of organizations, allowing the attacker to be selective and craft custom second-stage malware for the most lucrative targets. This model also allows an entire decentralized industry of cybercrime. An initial access group may sell access to a prime target like a bank or hospital to a ransomware gang, for example.

Exfiltrate Data

C2 channels are often bidirectional, meaning an attacker can download or “exfiltrate” data from the target environment in addition to sending instructions to compromised hosts. The stolen data can be anything from classified military documents to credit card numbers or personal information, depending on the victim’s organization. Increasingly, ransomware gangs are using data exfiltration as an added tactic to extort their targets; even if the organization can recover data from backups, the criminals will threaten to release stolen and potentially embarrassing information.

Other Uses

As stated earlier, botnets are frequently used to launch DDoS attacks against websites and other services. Instructions for which sites to attack are delivered over C2. Other types of instructions can also be issued to zombie machines over C2. For example, large crypto mining botnets have been identified. Even more exotic uses have been theorized, ranging from using C2 commands to disrupt elections ormanipulate energy markets.

Command and Control Models

Though there’s a wide variety of options for implementing C2, the architecture between malware and the C2 platform will usually look something like one of the following models:

Centralized

A centralized command and control model functions much like the traditional client-server relationship. A malware “client” will phone home to a C2 server and check for instructions. In practice, an attacker’s server-side infrastructure is often far more complex than a single server and may include redirectors, load balancers, and defense measures to detect security researchers and law enforcement. Public cloud services and Content Delivery Networks (CDNs) are frequently used to host or mask C2 activity. It’s also common for hackers to compromise legitimate websites and use them to host command and control servers without the owner’s knowledge.

C2 activity is often discovered fairly quickly, and the domains and servers associated with a campaign may be removed within hours of their first use. To combat this, modern malware is often coded with a list of many different C2 servers to try and reach. The most sophisticated attacks introduce additional layers of obfuscation. Malware has been observed fetching a list of C2 servers from GPS coordinates embedded in photos and from comments on Instagram.

Peer-to-Peer (P2P)

In a P2P C&C model, command and control instructions are delivered in a decentralized fashion, with members of a botnet relaying messages between one another. Some of the bots may still function as servers, but there is no central or “master” node. This makes it far more difficult to disrupt than a centralized model but can also make it more difficult for the attacker to issue instructions to the entire botnet. P2P networks are sometimes used as a fallback mechanism in case the primary C2 channel is disrupted.

Out of Band and Random

A number of unusual techniques have been observed for issuing instructions to infected hosts. Hackers have made extensive use of social media platforms as unconventional C2 platforms because they are rarely blocked. A project called Twittor aims to provide a fully functional command and control platform using only direct messages on Twitter. Hackers have also been observed using Gmail, IRC chat rooms, and even Pinterest to issue C&C messages to compromised hosts. It’s also been theorized that command and control infrastructure could be entirely random, with an attacker scanning large swaths of the Internet in hopes of finding an infected host.

Detecting and Preventing Command and Control Traffic

C2 traffic can be notoriously difficult to detect, as attackers go to great lengths to avoid being noticed. There’s a tremendous opportunity for defenders, however, as disrupting C2 can prevent a malware infection from turning into a more serious incident like a data breach. In fact, many large-scale cyber attacks were initially discovered when researchers noticed C2 activity. Here are a few general techniques for detecting and stopping command and control traffic in your own network:

Monitor and Filter Outbound Traffic

Many organizations pay little attention to traffic exiting their network, focusing instead on threats contained in incoming traffic. This lack of awareness facilitates an attacker’s command and control activities. Carefully crafted egress firewall rules can help impede an adversary’s ability to open up covert channels of communication. For example, limiting outbound DNS requests to only servers that the organization controls can reduce the threat of DNS tunneling. Proxies can be used to inspect outbound web traffic, but users must take care to configure SSL/TLS inspection, as hackers have embraced encryption along with the rest of the web. DNS filtering services can also be used to help prevent C2 callbacks to suspicious or newly registered domains.

Watch for Beacons

Beacons can be a tell-tale sign of command and control activity within your network, but they’re often difficult to spot. Most IDS/IPS solutions will pick up on beacons associated with off-the-shelf frameworks like Metasploit and Cobalt Strike, but these can easily be customized by attackers to make detection far more difficult. For deeper network traffic analysis (NTA), a tool like RITA can be used. In some cases, threat hunting teams will go so far as to manually inspect packet dumps using a tool like Wireshark or tcpdump.

Log and Inspect

Collecting log files from as many sources as possible is vital when hunting for signs of command and control traffic. Often, close analysis is needed to distinguish between C2 traffic and legitimate applications. Security Analysts may need to look for unusual patterns, examine the payloads of seemingly benign HTTPS or DNS requests, and perform other types of statistical analysis. The greater volume of information the analyst or threat hunter has to work with, the better. Remote logging and SIEM solutions can aid in this task.

Correlate Data from Multiple Sources

The whole point of maintaining a command and control infrastructure is to perform some specific action like accessing important files or infecting more hosts. Hunting for C&C activity from both a data and network perspective increases the likelihood of discovering well-camouflaged cyberattacks. This is exactly the approach that Varonis Edge takes, giving you the deep visibility required to spot everything from insider threats to APT groups.

Conclusion

Command and Control Infrastructure is essential to attackers – and represents an opportunity for defenders. Blocking C&C traffic or dismantling an adversary’s C2 infrastructure can halt a cyberattack in its tracks. Tackling C2 should never be an organization’s sole focus and should be part of a larger information security program that includes good “cyber hygiene” practices, security awareness training for employees, and well-thought-out policies and procedures. These steps can go a long way towards mitigating the threat posed by command and control infrastructure.

What should I do now?

Below are three ways you can continue your journey to reduce data risk at your company:

1

Schedule a demo with us to see Varonis in action. We'll personalize the session to your org's data security needs and answer any questions.

2

See a sample of our Data Risk Assessment and learn the risks that could be lingering in your environment. Varonis' DRA is completely free and offers a clear path to automated remediation.

3

Follow us on LinkedIn, YouTube, and X (Twitter) for bite-sized insights on all things data security, including DSPM, threat detection, AI security, and more.

Robert Grimmick Robert is an IT and cyber security consultant based in Southern California. He enjoys learning about the latest threats to computer security.

Try Varonis free.

Get a detailed data risk report based on your company’s data.Deploys in minutes. Get started View sample

Keep reading

Varonis tackles hundreds of use cases, making it the ultimate platform to stop data breaches and ensure compliance.

What is UPnP and why is it Dangerous? Michael Buckbee June 26, 2017 Learn what UPnP (Universal Plug and Play) is and about its potential dangers. Contact us today for all of your cybersecurity needs. The Malware Hiding in Your Windows System32 Folder: More Rundll32 and LoL Security Defense Tips Michael Buckbee July 19, 2018 When we left off last, I showed how it’s possible to run VBScript directly from mshta. I can play a similar trick with another LoL-ware binary, our old friend rundll32.... The Difference Between Bash and Powershell Michael Buckbee September 13, 2016 You don’t normally talk philosophy and IT when considering Bash and Powershell, but if it’s one thing I’ve learned over the past 20 years of sysadmin work it’s that whether... Master Fileless Malware Penetration Testing! Michael Buckbee October 5, 2018 Our five-part series brings you up to speed on stealthy techniques used by hackers. Learn how to sneakily run scripts with mshta, rundll32, and regsrvr32, scary Windows binaries that live...