Cloud C2 is command-and-control traffic that hides inside legitimate cloud services such as file sharing, document platforms, or code hosting sites. Instead of connecting directly to a known attacker server, malware checks in through a trusted service, making the traffic look like ordinary business use. This matters because security tools often treat these platforms as normal and necessary, so simple IP blocking or domain blocking may not stop the channel.
In real attacks, Cloud C2 can use services like spreadsheets, gists, or storage buckets to deliver commands, receive results, or stage data for exfiltration. Defenders look for unusual API patterns, suspicious browser or endpoint activity, and cloud access that does not match user behavior. Effective defenses include strong allowlisting, detailed proxy and DNS logging, cloud audit monitoring, and alerts for scripted or high-frequency access to services that should be used manually.