Command and Control: What Real Attacks Reveal About C2 Techniques

When it comes to cyber attacks, one of the most crucial—but often under-discussed—phases is Command and Control (C2). Once an attacker gains a foothold inside a target system, C2 is how they maintain communication with the compromised environment. From stealing data to deploying further payloads, C2 is the attacker’s lifeline.

But what do real-world attacks tell us about how threat actors actually operate C2 infrastructure? And more importantly, how can organisations spot the signs before the damage is done?

What Is Command and Control?

In basic terms, Command and Control refers to the infrastructure and protocols an attacker uses to issue commands and receive data from compromised systems. Think of it like the attacker’s “remote control”. If initial access is the burglar picking the lock, C2 is the walkie-talkie that keeps them in touch with their getaway driver.

C2 techniques range from the very basic to the highly advanced, and their stealth makes them one of the most difficult parts of an attack to detect.

Real Attacks, Real Techniques

Looking at real-world incidents gives us a clearer view of how attackers adapt their C2 strategies depending on the target, motivation, and the environment.

1. Living off the Land (LotL)

In attacks like those by APT29 (also known as Cozy Bear), threat actors use native Windows tools such as PowerShell, WMI, or certutil to set up C2 channels. Because these tools are signed and trusted, malicious activity is harder to distinguish from normal operations.

This “living off the land” approach means the attacker doesn’t need to drop additional malware, reducing the chances of detection by antivirus or EDR systems.

2. Domain Fronting and HTTPS

Some C2 servers are disguised behind legitimate services like Google, Amazon, or Cloudflare. Attackers use domain fronting to make C2 traffic appear as though it’s headed to a benign domain. Since the actual payloads are encrypted via HTTPS, traditional traffic inspection tools often can’t see what’s happening.

In the UK, the 2020 SolarWinds attack had clear evidence of domain fronting in its early-stage C2 traffic.

3. Beaconing and Sleep Cycles

Advanced malware like Cobalt Strike or Sliver employs beaconing techniques—periodic check-ins with the C2 server. These can be randomised or delayed to avoid detection. Some malware goes completely dormant until a specific command is received or a timer expires, bypassing behavioural detection.

In the Conti ransomware leaks, internal documents revealed heavy reliance on beaconing configurations tailored to evade security platforms.

Detection Is Hard—but Not Impossible

While C2 traffic is often hard to detect, it leaves behind subtle clues:

• Unusual DNS requests, such as those with algorithmically generated domain names (DGAs).

• Outbound connections to rare or newly registered domains.

• Inconsistent traffic patterns, especially from devices that normally don’t initiate external communications.

• Encrypted traffic on non-standard ports.

Organisations can use threat hunting, network monitoring, and endpoint detection tools to find and flag suspicious C2 behaviour. But more importantly, building resilience through segmentation, least privilege, and rapid response playbooks can limit the damage even if a C2 channel is successfully established.

Final Thoughts

C2 is where attackers consolidate their power—and where defenders must strike to regain control. The techniques we’ve seen in real attacks show an ever-evolving game of stealth and sophistication. But by studying these attacks, UK organisations can stay one step ahead.

In the world of cyber defence, knowing how the enemy communicates is half the battle.