Distributed C2, or distributed command-and-control, is an attacker setup that spreads control traffic across multiple servers instead of relying on one central host. In a malware campaign, infected devices may contact different endpoints for instructions, updates, or data exfiltration, which makes the infrastructure harder to map and easier for operators to replace if one server is blocked.
It matters because defenders often look for a single obvious C2 IP or domain to sinkhole or block. When control is split across several nodes, simple IP blocking and one-sample analysis become less effective. Security teams respond by correlating DNS, proxy, and endpoint telemetry, hunting for shared patterns across destinations, and watching for failover behavior. In real attacks, distributed C2 is often paired with phishing, geofencing, or rotating domains to reduce visibility and delay takedown.