Encrypted C2, or encrypted command-and-control, is malware control traffic that is wrapped in encryption before it leaves the infected device. The malware still sends instructions, status updates, and stolen data, but network tools cannot easily read the contents without the key. This matters because defenders often rely on visible patterns in cleartext traffic to identify botnets, loaders, or remote administration beacons.
In real attacks, encryption helps attackers hide tasking, blend in with normal secure traffic, and reduce the value of simple signature-based detection. It does not make the traffic invisible: defenders can still look for unusual destinations, abnormal timing, certificate oddities, repeated outbound connections, or encrypted sessions from devices that should not speak that way. In practice, encrypted C2 pushes detection toward behavior analysis, endpoint telemetry, and network baselining rather than payload inspection alone.