Command and control
Also called: C2 · C&C · command-and-control
The channel an attacker uses to communicate with compromised systems inside a victim network: sending commands, delivering tools and receiving stolen data. The traffic is usually disguised as ordinary web or DNS traffic. When an advisory lists C2 domains or IP addresses, block them at the firewall or DNS resolver and search logs for internal hosts that have already connected to them.
Further reading: attack.mitre.org
Advisories that mention this term
Attackers run self-hosted AntiFox AI pentest agents to plant webshells and steal AWS production secrets
BleepingComputer, citing Arctic Wolf, reports that attackers host self-managed instances of the open-source agentic pentest platform AntiFox, a fork of ARTEX 0.
ESET: Turla hides new Cereal toolset on government Exchange servers to collect NATO and EU correspondence
ESET said on November 10 that it found a previously undocumented modular .
XCPE Botnet: Android Set-Top Boxes Shipped with Preloaded Backdoor; ~88,000 Devices Infected in Taiwan, 5th Globally
Following Google's disclosure of the XCPE botnet, cybersecurity vendor TrendAI published observations from June 3 to October 1 showing approximately 1.
JPCERT/CC Warns Against Overlooking Watering Hole Attacks, Reviewing 2023 University-Related Case
According to Security NEXT, JPCERT/CC warned in 2024 against focusing solely on VPN vulnerabilities, citing a 2023 watering hole attack targeting university-affiliated individuals .