In the field of offensive security and red teaming, one of the most important concepts is C2 (Command & Control). This kind of infrastructure lets an attacker —or a controlled simulation team— stay in communication with compromised machines and run commands remotely.
Put simply: a C2 is the brain of a hacking operation. Without it, controlling the machines would be limited and hard to coordinate.
How C2s communicate
The key to a C2 is its ability to communicate covertly. The agents (malware or implants) installed on infected machines need to talk to the central server, and to do so they use channels that blend in with normal traffic:
- HTTP/HTTPS: the most common and easiest to disguise.
- DNS: heavily used in evasion techniques (DNS tunneling).
- Cloud services: such as Dropbox, Google Drive or AWS.
- Messaging: apps like Telegram or Discord.
On top of that, many C2s use a method known as beaconing, in which agents don’t keep a constant connection but instead “wake up” every so often to ask for instructions. This reduces visibility and makes detection harder.
Main components of a C2
A C2 is not a single program but a set of pieces working together. Its main components are:
- Payload: the initial load that runs on the target system and usually installs or downloads the agent.
- Agent: the software living on the compromised host that receives commands and sends back results.
- Beacon: a type of agent that communicates periodically, ideal for reducing network noise.
- Listener: the entry point that receives connections from agents and defines the communication protocol (HTTP, DNS, etc.).
- Team Server: the central server that coordinates the whole infrastructure and connects operators and agents.
- Operator: the person driving the C2, launching commands and managing the operation.
- Implant: the persistent code that guarantees access even after reboots or defensive measures.
Each part plays a specific role, but together they form the backbone of any command and control infrastructure.
Example of a basic architecture
To understand it better, here’s what a typical C2 workflow looks like:
- The payload is delivered to the target (via phishing, exploitation, USB, etc.).
- It runs on the system and installs an agent.
- The agent communicates with a listener, which connects it to the team server.
- The operator assigns tasks: steal credentials, run commands, move laterally.
- The agent returns the results through the beaconing mechanism.
- An implant ensures persistence and keeps access over time.
C2 in Red Teaming
Although the concept of a C2 is usually associated with real attacks, it’s also a fundamental tool in red teaming and ethical hacking.
Using it allows you to:
- Assess whether the defensive systems can detect suspicious traffic.
- Measure how quickly security teams react to an intrusion.
- Simulate realistic attack campaigns in controlled environments.
This way, C2s become a key piece for training defenses and improving the security of organizations.
Conclusion
A C2 (Command & Control) is much more than a simple server: it’s a full infrastructure designed to keep covert control over compromised systems.
Understanding its components, its communication methods and its role in red teaming exercises is essential for any professional who wants to go deeper into offensive and defensive security.