A command server, often called a C2 server, is the remote system that malware uses to receive instructions and sometimes send stolen data back to an attacker. It can tell an infected device what to run next, which files to collect, or when to stay quiet to avoid detection. In practice, this control channel is what turns a one-time infection into an ongoing operation.
Command servers matter because they are a key point of control and a common target for defenders. Security teams look for unusual outbound traffic, suspicious domains, repeated beaconing, and encrypted connections to unknown infrastructure. Attackers may hide command traffic in ordinary web requests, cloud services, or even blockchain-based data sources to make takedown harder. Blocking or disrupting the command server can stop malware from receiving updates, but it may not remove the infection already on the endpoint.