C2Server
A C2 server, or command-and-control server, is a centralized or distributed system that provides instructions to one or more compromised hosts in a malware network. The operator uses the C2 to issue commands, receive data exfiltrated from infected machines, and deploy updates or additional modules. C2s are a core component of many malware campaigns and can be operated on dedicated infrastructure or rented services.
Architecture can vary: a C2 may be centralized with a single server or distributed with redundant servers,
Communication channels vary as well: HTTP or HTTPS, DNS, or custom protocols over TCP or UDP. Traffic
Lifecycle and operations commonly include beaconing, authentication, command queuing, execution on the infected host, data collection,
Detection and defense focus on identifying unusual outbound traffic patterns, beaconing to suspicious infrastructure, TLS fingerprinting,